Analysis
- max time kernel
83s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe
- Size 208KB
- Sample260818-nlrwcssvcv
- SHA256 a18a01baa95ff40673f0898045360f1023b07f716f2640733e63693a440cb5d1
- MD5 b62af1b8f09ba6833b73abe0288130d3
- SHA1 95670d0753c84785b39179cf4641658fd3e4e171
- SHA512 72bc12190edd937e7588b2aa7a606b42938292e29d96221c5db429288eb204acbb398db04f693c4af891984db527bceccfe4eb095f271352b2093c1108c96b87
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfk4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOMQEj1
- TLSH T194247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1836 VKQJRN.exe 5124 RHC.exe 6088 BAMMG.exe 5476 OLC.exe 5632 ADFED.exe 5028 AHJ.exe 2072 UZRKZOI.exe 2848 UFRZBBD.exe 5268 JAADM.exe 2148 HVZ.exe 4684 RTFYY.exe 2144 BRTTN.exe 4712 FHZBSAH.exe 5468 JPGBE.exe 2932 JSKE.exe 2856 JXKL.exe 6012 NFRTXFV.exe 5780 FOT.exe 1420 DDEBWQ.exe 2068 BZDC.exe 4768 WMILKT.exe 3244 QHN.exe 3644 GCWHGF.exe 2908 OIWNHS.exe 4124 IVB.exe 1176 XQKJDF.exe 2080 VLKKHIG.exe 2936 HCQSLA.exe 1644 CPV.exe 5584 XCALG.exe 2212 ASHLSSU.exe 4448 VFLU.exe 2916 MGNHG.exe 4824 CJX.exe 4704 COXA.exe 4564 RJGELCX.exe 1776 ASI.exe 1948 LKDC.exe 5824 RLLQGR.exe 4492 JLN.exe 1548 MTUDW.exe 4744 FWXZ.exe 4460 JMMHOP.exe 1760 KHQ.exe 1968 IATTCLJ.exe 2776 CSIDTLR.exe 2300 TTP.exe 2408 MWAELSV.exe 4408 KGDUU.exe 2976 DJHYZWT.exe 3352 NHNLHFU.exe 6004 KIWVTB.exe 3464 ZDGZ.exe 1148 MBGLFZV.exe 3788 UOSSQFQ.exe 1076 EMYM.exe 1456 UHQQQBA.exe 4112 ACHRV.exe 4120 YSAU.exe 5216 RVEQO.exe 3276 XQD.exe 4168 ZOJ.exe 4352 BBNCK.exe 5512 FJUCWCI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FHZBSAH.exe BRTTN.exe File created C:\windows\SysWOW64\XQKJDF.exe IVB.exe File created C:\windows\SysWOW64\CSIDTLR.exe.bat IATTCLJ.exe File created C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\ZKE.exe.bat ORJC.exe File created C:\windows\SysWOW64\NFRTXFV.exe.bat JXKL.exe File created C:\windows\SysWOW64\OIWNHS.exe.bat GCWHGF.exe File opened for modification C:\windows\SysWOW64\ASI.exe RJGELCX.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe YSAU.exe File opened for modification C:\windows\SysWOW64\TPT.exe PHEEDT.exe File created C:\windows\SysWOW64\VQDU.exe IFUDVZ.exe File created C:\windows\SysWOW64\FHZBSAH.exe BRTTN.exe File created C:\windows\SysWOW64\XQKJDF.exe.bat IVB.exe File created C:\windows\SysWOW64\COXA.exe.bat CJX.exe File created C:\windows\SysWOW64\NHNLHFU.exe DJHYZWT.exe File created C:\windows\SysWOW64\IDQ.exe TNPMF.exe File created C:\windows\SysWOW64\AZGN.exe HEPJJA.exe File created C:\windows\SysWOW64\JNM.exe.bat TSCIO.exe File opened for modification C:\windows\SysWOW64\OIWNHS.exe GCWHGF.exe File created C:\windows\SysWOW64\KHQ.exe.bat JMMHOP.exe File created C:\windows\SysWOW64\JPGBE.exe.bat FHZBSAH.exe File created C:\windows\SysWOW64\RLLQGR.exe LKDC.exe File created C:\windows\SysWOW64\ZDGZ.exe.bat KIWVTB.exe File opened for modification C:\windows\SysWOW64\IDQ.exe TNPMF.exe File opened for modification C:\windows\SysWOW64\AZGN.exe HEPJJA.exe File opened for modification C:\windows\SysWOW64\WESBSP.exe CROR.exe File opened for modification C:\windows\SysWOW64\ZKE.exe ORJC.exe File opened for modification C:\windows\SysWOW64\RHC.exe VKQJRN.exe File created C:\windows\SysWOW64\DJHYZWT.exe KGDUU.exe File opened for modification C:\windows\SysWOW64\VSEVRC.exe LKCQFXJ.exe File created C:\windows\SysWOW64\HMJR.exe NRF.exe File opened for modification C:\windows\SysWOW64\VFLU.exe ASHLSSU.exe File created C:\windows\SysWOW64\VFLU.exe.bat ASHLSSU.exe File opened for modification C:\windows\SysWOW64\HMJR.exe NRF.exe File opened for modification C:\windows\SysWOW64\BZDC.exe DDEBWQ.exe File created C:\windows\SysWOW64\JMMHOP.exe FWXZ.exe File created C:\windows\SysWOW64\TNPMF.exe.bat ESGAUZN.exe File created C:\windows\SysWOW64\RHC.exe.bat VKQJRN.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe LPEDLZ.exe File created C:\windows\SysWOW64\BRTTN.exe.bat RTFYY.exe File created C:\windows\SysWOW64\OIWNHS.exe GCWHGF.exe File opened for modification C:\windows\SysWOW64\VLKKHIG.exe XQKJDF.exe File opened for modification C:\windows\SysWOW64\ZXX.exe RRX.exe File opened for modification C:\windows\SysWOW64\XCALG.exe CPV.exe File opened for modification C:\windows\SysWOW64\COXA.exe CJX.exe File opened for modification C:\windows\SysWOW64\NHNLHFU.exe DJHYZWT.exe File opened for modification C:\windows\SysWOW64\VKQJRN.exe 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe File created C:\windows\SysWOW64\BRTTN.exe RTFYY.exe File created C:\windows\SysWOW64\VLKKHIG.exe.bat XQKJDF.exe File created C:\windows\SysWOW64\YSAU.exe.bat ACHRV.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\WUHJYF.exe LPEDLZ.exe File opened for modification C:\windows\SysWOW64\BAMMG.exe RHC.exe File opened for modification C:\windows\SysWOW64\KHQ.exe JMMHOP.exe File created C:\windows\SysWOW64\TTP.exe.bat CSIDTLR.exe File created C:\windows\SysWOW64\NHNLHFU.exe.bat DJHYZWT.exe File created C:\windows\SysWOW64\LPEDLZ.exe YMAFYHO.exe File created C:\windows\SysWOW64\ARHO.exe AZGN.exe File created C:\windows\SysWOW64\HVZ.exe JAADM.exe File created C:\windows\SysWOW64\ASI.exe RJGELCX.exe File created C:\windows\SysWOW64\DJHYZWT.exe.bat KGDUU.exe File created C:\windows\SysWOW64\WESBSP.exe.bat CROR.exe File opened for modification C:\windows\SysWOW64\KJCM.exe FIU.exe File created C:\windows\SysWOW64\NRF.exe VQDU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\PIQ.exe ARHO.exe File created C:\windows\system\AMBABW.exe.bat TRS.exe File created C:\windows\system\RJGELCX.exe.bat COXA.exe File created C:\windows\MTUDW.exe JLN.exe File created C:\windows\system\MBGLFZV.exe.bat ZDGZ.exe File opened for modification C:\windows\TSCIO.exe ZXX.exe File created C:\windows\system\PHEEDT.exe GZKZ.exe File created C:\windows\system\CPV.exe HCQSLA.exe File opened for modification C:\windows\system\RJGELCX.exe COXA.exe File opened for modification C:\windows\KIWVTB.exe NHNLHFU.exe File created C:\windows\NQKSJ.exe ZKE.exe File created C:\windows\NQKSJ.exe.bat ZKE.exe File created C:\windows\JLN.exe.bat RLLQGR.exe File created C:\windows\KGDUU.exe MWAELSV.exe File created C:\windows\system\MBGLFZV.exe ZDGZ.exe File opened for modification C:\windows\system\GBFUQE.exe NYORUH.exe File created C:\windows\KVNPK.exe.bat PIQ.exe File created C:\windows\system\GZKZ.exe.bat URWRNEI.exe File created C:\windows\JXKL.exe JSKE.exe File opened for modification C:\windows\system\DDEBWQ.exe FOT.exe File created C:\windows\system\MWAELSV.exe TTP.exe File created C:\windows\system\EMYM.exe UOSSQFQ.exe File opened for modification C:\windows\system\XQD.exe RVEQO.exe File opened for modification C:\windows\FIU.exe IDOBLUD.exe File opened for modification C:\windows\ADFED.exe OLC.exe File opened for modification C:\windows\system\AHJ.exe ADFED.exe File created C:\windows\JXKL.exe.bat JSKE.exe File created C:\windows\MGNHG.exe VFLU.exe File created C:\windows\system\ACHRV.exe UHQQQBA.exe File created C:\windows\system\FJUCWCI.exe BBNCK.exe File created C:\windows\system\DDEBWQ.exe FOT.exe File created C:\windows\FWXZ.exe MTUDW.exe File created C:\windows\JOKODZJ.exe.bat ILG.exe File created C:\windows\system\URWRNEI.exe KJCM.exe File created C:\windows\system\PHEEDT.exe.bat GZKZ.exe File opened for modification C:\windows\IVB.exe OIWNHS.exe File created C:\windows\system\LKDC.exe.bat ASI.exe File created C:\windows\system\ACHRV.exe.bat UHQQQBA.exe File created C:\windows\system\ESGAUZN.exe.bat VSEVRC.exe File created C:\windows\TSCIO.exe ZXX.exe File created C:\windows\CZG.exe AMBABW.exe File opened for modification C:\windows\KGDUU.exe MWAELSV.exe File opened for modification C:\windows\system\MBGLFZV.exe ZDGZ.exe File created C:\windows\system\EMYM.exe.bat UOSSQFQ.exe File created C:\windows\system\ESGAUZN.exe VSEVRC.exe File opened for modification C:\windows\system\HEPJJA.exe GBFUQE.exe File created C:\windows\system\ORJC.exe.bat CZG.exe File created C:\windows\UZRKZOI.exe.bat AHJ.exe File created C:\windows\system\JAADM.exe UFRZBBD.exe File opened for modification C:\windows\JXKL.exe JSKE.exe File opened for modification C:\windows\system\ESGAUZN.exe VSEVRC.exe File created C:\windows\YGZQXU.exe IDQ.exe File created C:\windows\system\GBFUQE.exe NYORUH.exe File created C:\windows\system\BQQQNEQ.exe JNM.exe File opened for modification C:\windows\CZG.exe AMBABW.exe File created C:\windows\system\OLC.exe BAMMG.exe File opened for modification C:\windows\system\GCWHGF.exe QHN.exe File created C:\windows\system\RJGELCX.exe COXA.exe File created C:\windows\KIWVTB.exe.bat NHNLHFU.exe File created C:\windows\PQHMUK.exe.bat WUHJYF.exe File created C:\windows\system\PIQ.exe ARHO.exe File opened for modification C:\windows\NQKSJ.exe ZKE.exe File opened for modification C:\windows\system\URWRNEI.exe KJCM.exe File created C:\windows\system\OLC.exe.bat BAMMG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2868 cmd.exe 5180 cmd.exe 5156 cmd.exe 1220 cmd.exe 2232 cmd.exe 1584 cmd.exe 2760 cmd.exe 1748 cmd.exe 4268 cmd.exe 4760 cmd.exe 4272 cmd.exe 4192 cmd.exe 3728 cmd.exe 4468 cmd.exe 4160 cmd.exe 4236 cmd.exe 5012 cmd.exe 4848 cmd.exe 5456 cmd.exe 244 cmd.exe 1600 cmd.exe 252 cmd.exe 2360 cmd.exe 4832 cmd.exe 3704 cmd.exe 5240 cmd.exe 124 cmd.exe 5284 cmd.exe 4388 cmd.exe 2732 cmd.exe 5020 cmd.exe 2788 cmd.exe 2388 cmd.exe 4660 cmd.exe 5684 cmd.exe 2836 cmd.exe 4380 cmd.exe 3980 cmd.exe 2924 cmd.exe 4544 cmd.exe 4344 cmd.exe 4600 cmd.exe 4656 cmd.exe 620 cmd.exe 2520 cmd.exe 5940 cmd.exe 5920 cmd.exe 4080 cmd.exe 1492 cmd.exe 2804 cmd.exe 5988 cmd.exe 3744 cmd.exe 3252 cmd.exe 4488 cmd.exe 4452 cmd.exe 2424 cmd.exe 3940 cmd.exe 2884 cmd.exe 4512 cmd.exe 5316 cmd.exe 3000 cmd.exe 5676 cmd.exe 1488 cmd.exe 1896 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3980 4596 WerFault.exe 87 1748 1836 WerFault.exe 93 4124 5124 WerFault.exe 99 3164 6088 WerFault.exe 104 2408 5476 WerFault.exe 109 5544 5632 WerFault.exe 114 3456 5028 WerFault.exe 119 2656 2072 WerFault.exe 124 3380 2848 WerFault.exe 129 3316 5268 WerFault.exe 134 3464 2148 WerFault.exe 139 5836 4684 WerFault.exe 144 6032 2144 WerFault.exe 149 3580 4712 WerFault.exe 154 880 5468 WerFault.exe 159 2796 2932 WerFault.exe 164 2936 2856 WerFault.exe 169 3456 6012 WerFault.exe 174 3856 5780 WerFault.exe 179 4700 1420 WerFault.exe 184 4592 2068 WerFault.exe 189 4244 4768 WerFault.exe 194 5852 3244 WerFault.exe 199 1060 3644 WerFault.exe 204 4960 2908 WerFault.exe 209 2548 4124 WerFault.exe 214 5872 1176 WerFault.exe 219 2920 2080 WerFault.exe 224 560 2936 WerFault.exe 229 2484 1644 WerFault.exe 234 5752 5584 WerFault.exe 239 4168 2212 WerFault.exe 244 5612 4448 WerFault.exe 249 4156 2916 WerFault.exe 254 4884 4824 WerFault.exe 259 3480 4704 WerFault.exe 264 4508 4564 WerFault.exe 269 5872 1776 WerFault.exe 274 5136 1948 WerFault.exe 280 956 5824 WerFault.exe 285 1028 4492 WerFault.exe 290 4700 1548 WerFault.exe 295 4592 4744 WerFault.exe 300 4220 4460 WerFault.exe 305 3376 1760 WerFault.exe 310 5076 1968 WerFault.exe 315 5464 2776 WerFault.exe 320 2620 2300 WerFault.exe 325 5280 2408 WerFault.exe 330 2992 4408 WerFault.exe 335 4876 2976 WerFault.exe 340 1448 3352 WerFault.exe 345 4496 6004 WerFault.exe 350 3248 3464 WerFault.exe 355 4288 1148 WerFault.exe 360 3480 3788 WerFault.exe 365 2852 1076 WerFault.exe 370 3988 1456 WerFault.exe 375 616 4112 WerFault.exe 380 1964 4120 WerFault.exe 385 1632 5216 WerFault.exe 390 5636 3276 WerFault.exe 395 5336 4168 WerFault.exe 400 4212 4352 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFRZBBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJGELCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMBABW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAMMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCWHGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGNHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOKODZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSEVRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESGAUZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPEDLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CROR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQHMUK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4596 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe 4596 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe 1836 VKQJRN.exe 1836 VKQJRN.exe 5124 RHC.exe 5124 RHC.exe 6088 BAMMG.exe 6088 BAMMG.exe 5476 OLC.exe 5476 OLC.exe 5632 ADFED.exe 5632 ADFED.exe 5028 AHJ.exe 5028 AHJ.exe 2072 UZRKZOI.exe 2072 UZRKZOI.exe 2848 UFRZBBD.exe 2848 UFRZBBD.exe 5268 JAADM.exe 5268 JAADM.exe 2148 HVZ.exe 2148 HVZ.exe 4684 RTFYY.exe 4684 RTFYY.exe 2144 BRTTN.exe 2144 BRTTN.exe 4712 FHZBSAH.exe 4712 FHZBSAH.exe 5468 JPGBE.exe 5468 JPGBE.exe 2932 JSKE.exe 2932 JSKE.exe 2856 JXKL.exe 2856 JXKL.exe 6012 NFRTXFV.exe 6012 NFRTXFV.exe 5780 FOT.exe 5780 FOT.exe 1420 DDEBWQ.exe 1420 DDEBWQ.exe 2068 BZDC.exe 2068 BZDC.exe 4768 WMILKT.exe 4768 WMILKT.exe 3244 QHN.exe 3244 QHN.exe 3644 GCWHGF.exe 3644 GCWHGF.exe 2908 OIWNHS.exe 2908 OIWNHS.exe 4124 IVB.exe 4124 IVB.exe 1176 XQKJDF.exe 1176 XQKJDF.exe 2080 VLKKHIG.exe 2080 VLKKHIG.exe 2936 HCQSLA.exe 2936 HCQSLA.exe 1644 CPV.exe 1644 CPV.exe 5584 XCALG.exe 5584 XCALG.exe 2212 ASHLSSU.exe 2212 ASHLSSU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4596 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe 4596 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe 1836 VKQJRN.exe 1836 VKQJRN.exe 5124 RHC.exe 5124 RHC.exe 6088 BAMMG.exe 6088 BAMMG.exe 5476 OLC.exe 5476 OLC.exe 5632 ADFED.exe 5632 ADFED.exe 5028 AHJ.exe 5028 AHJ.exe 2072 UZRKZOI.exe 2072 UZRKZOI.exe 2848 UFRZBBD.exe 2848 UFRZBBD.exe 5268 JAADM.exe 5268 JAADM.exe 2148 HVZ.exe 2148 HVZ.exe 4684 RTFYY.exe 4684 RTFYY.exe 2144 BRTTN.exe 2144 BRTTN.exe 4712 FHZBSAH.exe 4712 FHZBSAH.exe 5468 JPGBE.exe 5468 JPGBE.exe 2932 JSKE.exe 2932 JSKE.exe 2856 JXKL.exe 2856 JXKL.exe 6012 NFRTXFV.exe 6012 NFRTXFV.exe 5780 FOT.exe 5780 FOT.exe 1420 DDEBWQ.exe 1420 DDEBWQ.exe 2068 BZDC.exe 2068 BZDC.exe 4768 WMILKT.exe 4768 WMILKT.exe 3244 QHN.exe 3244 QHN.exe 3644 GCWHGF.exe 3644 GCWHGF.exe 2908 OIWNHS.exe 2908 OIWNHS.exe 4124 IVB.exe 4124 IVB.exe 1176 XQKJDF.exe 1176 XQKJDF.exe 2080 VLKKHIG.exe 2080 VLKKHIG.exe 2936 HCQSLA.exe 2936 HCQSLA.exe 1644 CPV.exe 1644 CPV.exe 5584 XCALG.exe 5584 XCALG.exe 2212 ASHLSSU.exe 2212 ASHLSSU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 2868 4596 2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe 89 PID 2868 wrote to memory of 1836 2868 cmd.exe 93 PID 1836 wrote to memory of 4536 1836 VKQJRN.exe 95 PID 4536 wrote to memory of 5124 4536 cmd.exe 99 PID 5124 wrote to memory of 1232 5124 RHC.exe 100 PID 1232 wrote to memory of 6088 1232 cmd.exe 104 PID 6088 wrote to memory of 1592 6088 BAMMG.exe 105 PID 1592 wrote to memory of 5476 1592 cmd.exe 109 PID 5476 wrote to memory of 2208 5476 OLC.exe 110 PID 2208 wrote to memory of 5632 2208 cmd.exe 114 PID 5632 wrote to memory of 5756 5632 ADFED.exe 115 PID 5756 wrote to memory of 5028 5756 cmd.exe 119 PID 5028 wrote to memory of 2928 5028 AHJ.exe 120 PID 2928 wrote to memory of 2072 2928 cmd.exe 124 PID 2072 wrote to memory of 4600 2072 UZRKZOI.exe 125 PID 4600 wrote to memory of 2848 4600 cmd.exe 129 PID 2848 wrote to memory of 2596 2848 UFRZBBD.exe 130 PID 2596 wrote to memory of 5268 2596 cmd.exe 134 PID 5268 wrote to memory of 3096 5268 JAADM.exe 135 PID 3096 wrote to memory of 2148 3096 cmd.exe 139 PID 2148 wrote to memory of 4656 2148 HVZ.exe 140 PID 4656 wrote to memory of 4684 4656 cmd.exe 144 PID 4684 wrote to memory of 4240 4684 RTFYY.exe 145 PID 4240 wrote to memory of 2144 4240 cmd.exe 149 PID 2144 wrote to memory of 2904 2144 BRTTN.exe 150 PID 2904 wrote to memory of 4712 2904 cmd.exe 154 PID 4712 wrote to memory of 5240 4712 FHZBSAH.exe 155 PID 5240 wrote to memory of 5468 5240 cmd.exe 159 PID 5468 wrote to memory of 5448 5468 JPGBE.exe 160 PID 5448 wrote to memory of 2932 5448 cmd.exe 164 PID 2932 wrote to memory of 2688 2932 JSKE.exe 165 PID 2688 wrote to memory of 2856 2688 cmd.exe 169 PID 2856 wrote to memory of 5644 2856 JXKL.exe 170 PID 5644 wrote to memory of 6012 5644 cmd.exe 174 PID 6012 wrote to memory of 3892 6012 NFRTXFV.exe 175 PID 3892 wrote to memory of 5780 3892 cmd.exe 179 PID 5780 wrote to memory of 3940 5780 FOT.exe 180 PID 3940 wrote to memory of 1420 3940 cmd.exe 184 PID 1420 wrote to memory of 2256 1420 DDEBWQ.exe 185 PID 2256 wrote to memory of 2068 2256 cmd.exe 189 PID 2068 wrote to memory of 4660 2068 BZDC.exe 190 PID 4660 wrote to memory of 4768 4660 cmd.exe 194 PID 4768 wrote to memory of 5684 4768 WMILKT.exe 195 PID 5684 wrote to memory of 3244 5684 cmd.exe 199 PID 3244 wrote to memory of 620 3244 QHN.exe 200 PID 620 wrote to memory of 3644 620 cmd.exe 204 PID 3644 wrote to memory of 1492 3644 GCWHGF.exe 205 PID 1492 wrote to memory of 2908 1492 cmd.exe 209 PID 2908 wrote to memory of 2952 2908 OIWNHS.exe 210 PID 2952 wrote to memory of 4124 2952 cmd.exe 214 PID 4124 wrote to memory of 2720 4124 IVB.exe 215 PID 2720 wrote to memory of 1176 2720 cmd.exe 219 PID 1176 wrote to memory of 2264 1176 XQKJDF.exe 220 PID 2264 wrote to memory of 2080 2264 cmd.exe 224 PID 2080 wrote to memory of 5744 2080 VLKKHIG.exe 225 PID 5744 wrote to memory of 2936 5744 cmd.exe 229 PID 2936 wrote to memory of 2836 2936 HCQSLA.exe 230 PID 2836 wrote to memory of 1644 2836 cmd.exe 234 PID 1644 wrote to memory of 1932 1644 CPV.exe 235 PID 1932 wrote to memory of 5584 1932 cmd.exe 239 PID 5584 wrote to memory of 5456 5584 XCALG.exe 240 PID 5456 wrote to memory of 2212 5456 cmd.exe 244 PID 2212 wrote to memory of 5376 2212 ASHLSSU.exe 245 PID 5376 wrote to memory of 4448 5376 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_b62af1b8f09ba6833b73abe0288130d3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKQJRN.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\SysWOW64\VKQJRN.exeC:\windows\system32\VKQJRN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHC.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\RHC.exeC:\windows\system32\RHC.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAMMG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\windows\SysWOW64\BAMMG.exeC:\windows\system32\BAMMG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\windows\system\OLC.exeC:\windows\system\OLC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADFED.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\ADFED.exeC:\windows\ADFED.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AHJ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\AHJ.exeC:\windows\system\AHJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZRKZOI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\UZRKZOI.exeC:\windows\UZRKZOI.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFRZBBD.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\SysWOW64\UFRZBBD.exeC:\windows\system32\UFRZBBD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JAADM.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\JAADM.exeC:\windows\system\JAADM.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVZ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\SysWOW64\HVZ.exeC:\windows\system32\HVZ.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTFYY.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\RTFYY.exeC:\windows\RTFYY.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRTTN.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\BRTTN.exeC:\windows\system32\BRTTN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHZBSAH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\FHZBSAH.exeC:\windows\system32\FHZBSAH.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPGBE.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\windows\SysWOW64\JPGBE.exeC:\windows\system32\JPGBE.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSKE.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\SysWOW64\JSKE.exeC:\windows\system32\JSKE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXKL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\JXKL.exeC:\windows\JXKL.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFRTXFV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\SysWOW64\NFRTXFV.exeC:\windows\system32\NFRTXFV.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOT.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\FOT.exeC:\windows\FOT.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDEBWQ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\system\DDEBWQ.exeC:\windows\system\DDEBWQ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZDC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\windows\SysWOW64\BZDC.exeC:\windows\system32\BZDC.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMILKT.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\system\WMILKT.exeC:\windows\system\WMILKT.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\system\QHN.exeC:\windows\system\QHN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCWHGF.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\system\GCWHGF.exeC:\windows\system\GCWHGF.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIWNHS.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\SysWOW64\OIWNHS.exeC:\windows\system32\OIWNHS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\IVB.exeC:\windows\IVB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VLKKHIG.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\SysWOW64\VLKKHIG.exeC:\windows\system32\VLKKHIG.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPV.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\system\CPV.exeC:\windows\system\CPV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCALG.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\SysWOW64\XCALG.exeC:\windows\system32\XCALG.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASHLSSU.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\system\ASHLSSU.exeC:\windows\system\ASHLSSU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFLU.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\SysWOW64\VFLU.exeC:\windows\system32\VFLU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "66⤵PID:2752
-
C:\windows\MGNHG.exeC:\windows\MGNHG.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\windows\CJX.exeC:\windows\CJX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "70⤵PID:1308
-
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "72⤵
- Executes a command shell one-liner
PID:124 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASI.exe.bat" "74⤵PID:2428
-
C:\windows\SysWOW64\ASI.exeC:\windows\system32\ASI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "76⤵PID:1604
-
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2804 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "80⤵PID:1260
-
C:\windows\JLN.exeC:\windows\JLN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTUDW.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4380 -
C:\windows\MTUDW.exeC:\windows\MTUDW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWXZ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\windows\FWXZ.exeC:\windows\FWXZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMMHOP.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\SysWOW64\JMMHOP.exeC:\windows\system32\JMMHOP.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "88⤵PID:5664
-
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IATTCLJ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\windows\system\IATTCLJ.exeC:\windows\system\IATTCLJ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSIDTLR.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5284 -
C:\windows\SysWOW64\CSIDTLR.exeC:\windows\system32\CSIDTLR.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTP.exe.bat" "94⤵PID:1072
-
C:\windows\SysWOW64\TTP.exeC:\windows\system32\TTP.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWAELSV.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5988 -
C:\windows\system\MWAELSV.exeC:\windows\system\MWAELSV.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "98⤵PID:2548
-
C:\windows\KGDUU.exeC:\windows\KGDUU.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJHYZWT.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4388 -
C:\windows\SysWOW64\DJHYZWT.exeC:\windows\system32\DJHYZWT.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5188 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWVTB.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2520 -
C:\windows\KIWVTB.exeC:\windows\KIWVTB.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4268 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "108⤵PID:2012
-
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOSSQFQ.exe.bat" "110⤵PID:5696
-
C:\windows\system\UOSSQFQ.exeC:\windows\system\UOSSQFQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3980 -
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe113⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHQQQBA.exe.bat" "114⤵PID:1264
-
C:\windows\UHQQQBA.exeC:\windows\UHQQQBA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACHRV.exe.bat" "116⤵PID:1216
-
C:\windows\system\ACHRV.exeC:\windows\system\ACHRV.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSAU.exe.bat" "118⤵PID:3020
-
C:\windows\SysWOW64\YSAU.exeC:\windows\system32\YSAU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEQO.exe.bat" "120⤵PID:3220
-
C:\windows\SysWOW64\RVEQO.exeC:\windows\system32\RVEQO.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-