Analysis
- max time kernel
95s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe
- Size 208KB
- Sample260819-bqq4eabq21
- SHA256 556feaf622b0400dc30196b7510730ea76bb9714b7b8d664c846f4849dee67ac
- MD5 fc14d82bffcb79ccf47430e59376573b
- SHA1 45c21862e383e68bc709f4f1512187a982d5a58c
- SHA512 fbf8e2379077856224425dd8431afe9472dd8ceda5af1824f0b74744d82a200f60be3d093d1f6576d62bf4c22085e768b192dc8b692ceea092e6fb1629ce6358
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf04pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOckEj1
- TLSH T1D6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6112 EEEWRY.exe 5700 ACQI.exe 5416 IKH.exe 2148 JNLYPEJ.exe 5536 NVRY.exe 972 CQBKMJF.exe 4188 LYD.exe 4488 MUGLD.exe 968 GPLUFFY.exe 5364 BCQE.exe 4608 WPVVA.exe 4112 FYXA.exe 4544 LYEO.exe 5448 XGL.exe 3512 XMDD.exe 1684 RHIMKB.exe 2436 VPX.exe 5060 ZFDUJM.exe 4160 LNK.exe 4820 GAPMX.exe 5444 YDTH.exe 3804 ZGWLQK.exe 264 FHE.exe 2508 MXFQGZ.exe 1488 XPIJO.exe 5344 DQQ.exe 4092 PILP.exe 5620 EDCURLN.exe 5044 IGAPQ.exe 4192 EMYM.exe 5556 KMGAPIA.exe 4952 UMI.exe 4812 LASXIK.exe 2728 LFSLJP.exe 3424 FTX.exe 2980 GWBQZNJ.exe 3112 VRK.exe 2984 GJNV.exe 2548 MKVJJJB.exe 860 WSX.exe 2388 SXVLU.exe 1288 NLAVEQ.exe 4612 NQAJGDW.exe 6040 RGGJ.exe 4628 DONJEGG.exe 4600 HEURIY.exe 2524 HKUGSLX.exe 1588 BXZP.exe 620 WLEZE.exe 5864 NYORUH.exe 6108 TTNR.exe 4916 AOXEKXN.exe 1536 RPZ.exe 2220 MKDSY.exe 3456 WIJNFDM.exe 2648 UIRAW.exe 4384 LITFZC.exe 3348 RJA.exe 4284 ITR.exe 3412 RHBJYW.exe 4104 IHD.exe 4412 VSMNQE.exe 3188 LIVE.exe 704 PQBMIK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AOXEKXN.exe TTNR.exe File opened for modification C:\windows\SysWOW64\IKGNYZC.exe ECANM.exe File created C:\windows\SysWOW64\WPVVA.exe.bat BCQE.exe File created C:\windows\SysWOW64\XADPX.exe WCVG.exe File opened for modification C:\windows\SysWOW64\NPQONW.exe QSKRGMK.exe File opened for modification C:\windows\SysWOW64\HCPXUK.exe YCV.exe File created C:\windows\SysWOW64\VPX.exe RHIMKB.exe File created C:\windows\SysWOW64\QZG.exe.bat FHDONKL.exe File created C:\windows\SysWOW64\LITFZC.exe.bat UIRAW.exe File created C:\windows\SysWOW64\JZNH.exe.bat RRL.exe File created C:\windows\SysWOW64\DINKVS.exe ZFP.exe File opened for modification C:\windows\SysWOW64\NWEDTPL.exe JGXD.exe File opened for modification C:\windows\SysWOW64\ZZB.exe UYUULT.exe File opened for modification C:\windows\SysWOW64\FZJWDX.exe ZZB.exe File created C:\windows\SysWOW64\FYXA.exe.bat WPVVA.exe File created C:\windows\SysWOW64\PILP.exe DQQ.exe File created C:\windows\SysWOW64\ITR.exe RJA.exe File created C:\windows\SysWOW64\ZZB.exe.bat UYUULT.exe File created C:\windows\SysWOW64\KGAOYM.exe PSVF.exe File opened for modification C:\windows\SysWOW64\SWRZ.exe KJEK.exe File created C:\windows\SysWOW64\WSX.exe.bat MKVJJJB.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat RHLHZ.exe File created C:\windows\SysWOW64\ZZB.exe UYUULT.exe File opened for modification C:\windows\SysWOW64\BLIA.exe VQJZOL.exe File created C:\windows\SysWOW64\BLIA.exe.bat VQJZOL.exe File opened for modification C:\windows\SysWOW64\GPLUFFY.exe MUGLD.exe File created C:\windows\SysWOW64\UMI.exe KMGAPIA.exe File created C:\windows\SysWOW64\SQY.exe.bat ZNUQJU.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe PGUV.exe File created C:\windows\SysWOW64\FHDONKL.exe EBLZLX.exe File created C:\windows\SysWOW64\LITFZC.exe UIRAW.exe File opened for modification C:\windows\SysWOW64\NUH.exe MREH.exe File created C:\windows\SysWOW64\ACQI.exe.bat EEEWRY.exe File created C:\windows\SysWOW64\YSNBMG.exe ZAKL.exe File opened for modification C:\windows\SysWOW64\FHDONKL.exe EBLZLX.exe File opened for modification C:\windows\SysWOW64\JNLYPEJ.exe IKH.exe File created C:\windows\SysWOW64\TTNR.exe NYORUH.exe File opened for modification C:\windows\SysWOW64\XADPX.exe WCVG.exe File created C:\windows\SysWOW64\NUH.exe.bat MREH.exe File opened for modification C:\windows\SysWOW64\ILTZTGV.exe CLLLK.exe File created C:\windows\SysWOW64\JGXD.exe ILTZTGV.exe File created C:\windows\SysWOW64\HCPXUK.exe YCV.exe File created C:\windows\SysWOW64\GPLUFFY.exe MUGLD.exe File created C:\windows\SysWOW64\VPX.exe.bat RHIMKB.exe File created C:\windows\SysWOW64\TTNR.exe.bat NYORUH.exe File created C:\windows\SysWOW64\GPLUFFY.exe.bat MUGLD.exe File created C:\windows\SysWOW64\AOXEKXN.exe.bat TTNR.exe File created C:\windows\SysWOW64\SWRZ.exe KJEK.exe File created C:\windows\SysWOW64\ZGWLQK.exe YDTH.exe File opened for modification C:\windows\SysWOW64\UMI.exe KMGAPIA.exe File created C:\windows\SysWOW64\DONJEGG.exe RGGJ.exe File created C:\windows\SysWOW64\QZG.exe FHDONKL.exe File created C:\windows\SysWOW64\DINKVS.exe.bat ZFP.exe File created C:\windows\SysWOW64\ACQI.exe EEEWRY.exe File created C:\windows\SysWOW64\AOXEKXN.exe TTNR.exe File opened for modification C:\windows\SysWOW64\KJEK.exe KGAOYM.exe File created C:\windows\SysWOW64\ZGWLQK.exe.bat YDTH.exe File created C:\windows\SysWOW64\ITR.exe.bat RJA.exe File created C:\windows\SysWOW64\FYXA.exe WPVVA.exe File opened for modification C:\windows\SysWOW64\FYXA.exe WPVVA.exe File opened for modification C:\windows\SysWOW64\ZGWLQK.exe YDTH.exe File created C:\windows\SysWOW64\HEURIY.exe DONJEGG.exe File opened for modification C:\windows\SysWOW64\HEURIY.exe DONJEGG.exe File opened for modification C:\windows\SysWOW64\YSNBMG.exe ZAKL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\BXZP.exe HKUGSLX.exe File opened for modification C:\windows\ZAKL.exe MXUU.exe File created C:\windows\VQJZOL.exe RAC.exe File opened for modification C:\windows\ZFDUJM.exe VPX.exe File created C:\windows\XPIJO.exe.bat MXFQGZ.exe File created C:\windows\system\RPZ.exe.bat AOXEKXN.exe File created C:\windows\system\JHV.exe XZOW.exe File created C:\windows\system\GLJNC.exe SQY.exe File opened for modification C:\windows\system\LRUUBY.exe SWRZ.exe File created C:\windows\system\EKKFKZ.exe.bat LRUUBY.exe File opened for modification C:\windows\system\LYD.exe CQBKMJF.exe File created C:\windows\MXFQGZ.exe.bat FHE.exe File created C:\windows\GWBQZNJ.exe FTX.exe File created C:\windows\ZFP.exe EKKFKZ.exe File opened for modification C:\windows\RAC.exe HCPXUK.exe File opened for modification C:\windows\system\EMYM.exe IGAPQ.exe File opened for modification C:\windows\system\RGGJ.exe NQAJGDW.exe File created C:\windows\system\DQQ.exe XPIJO.exe File created C:\windows\MKDSY.exe.bat RPZ.exe File opened for modification C:\windows\system\GOMGPJH.exe DINKVS.exe File created C:\windows\RHIMKB.exe.bat XMDD.exe File opened for modification C:\windows\EDCURLN.exe PILP.exe File created C:\windows\GWBQZNJ.exe.bat FTX.exe File opened for modification C:\windows\LFKBKDA.exe NUH.exe File opened for modification C:\windows\system\IGAPQ.exe EDCURLN.exe File created C:\windows\UIRAW.exe WIJNFDM.exe File created C:\windows\system\WCVG.exe.bat JZNH.exe File created C:\windows\system\CXLX.exe IKGNYZC.exe File created C:\windows\FHE.exe.bat ZGWLQK.exe File created C:\windows\NYORUH.exe WLEZE.exe File opened for modification C:\windows\IHD.exe RHBJYW.exe File opened for modification C:\windows\RRL.exe EGCEP.exe File created C:\windows\ZAKL.exe.bat MXUU.exe File created C:\windows\PSVF.exe.bat WPSBIWJ.exe File opened for modification C:\windows\CLLLK.exe CXLX.exe File opened for modification C:\windows\UYUULT.exe ZLXD.exe File created C:\windows\GAPMX.exe LNK.exe File created C:\windows\system\PQBMIK.exe.bat LIVE.exe File opened for modification C:\windows\PSVF.exe WPSBIWJ.exe File opened for modification C:\windows\system\YCV.exe FZJWDX.exe File created C:\windows\TRDE.exe.bat NWEDTPL.exe File created C:\windows\XPIJO.exe MXFQGZ.exe File created C:\windows\system\GJNV.exe.bat VRK.exe File opened for modification C:\windows\MKDSY.exe RPZ.exe File created C:\windows\system\GOMGPJH.exe.bat DINKVS.exe File created C:\windows\RAC.exe.bat HCPXUK.exe File opened for modification C:\windows\system\IKH.exe ACQI.exe File opened for modification C:\windows\system\LYEO.exe FYXA.exe File opened for modification C:\windows\RHIMKB.exe XMDD.exe File created C:\windows\system\RGGJ.exe.bat NQAJGDW.exe File created C:\windows\system\HKUGSLX.exe.bat HEURIY.exe File created C:\windows\CAUJQ.exe YSNBMG.exe File created C:\windows\system\IKH.exe ACQI.exe File created C:\windows\LNK.exe.bat ZFDUJM.exe File created C:\windows\ZNUQJU.exe.bat XADPX.exe File created C:\windows\system\LIVE.exe VSMNQE.exe File created C:\windows\system\EGCEP.exe PQBMIK.exe File created C:\windows\system\MUGLD.exe.bat LYD.exe File opened for modification C:\windows\FHE.exe ZGWLQK.exe File created C:\windows\system\IGAPQ.exe.bat EDCURLN.exe File created C:\windows\RHBJYW.exe.bat ITR.exe File opened for modification C:\windows\system\JHV.exe XZOW.exe File opened for modification C:\windows\LNK.exe ZFDUJM.exe File created C:\windows\system\PGUV.exe.bat CAUJQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 724 cmd.exe 1144 cmd.exe 5600 cmd.exe 1444 cmd.exe 3500 cmd.exe 5476 cmd.exe 1880 cmd.exe 4968 cmd.exe 5572 cmd.exe 3576 cmd.exe 4388 cmd.exe 864 cmd.exe 1992 cmd.exe 2860 cmd.exe 3904 cmd.exe 5256 cmd.exe 4680 cmd.exe 6060 cmd.exe 2872 cmd.exe 3268 cmd.exe 4668 cmd.exe 4416 cmd.exe 5972 cmd.exe 5752 cmd.exe 1372 cmd.exe 4652 cmd.exe 2056 cmd.exe 4168 cmd.exe 4924 cmd.exe 2896 cmd.exe 4480 cmd.exe 4372 cmd.exe 3264 cmd.exe 4520 cmd.exe 1076 cmd.exe 1340 cmd.exe 1148 cmd.exe 1116 cmd.exe 4376 cmd.exe 3324 cmd.exe 4552 cmd.exe 2104 cmd.exe 4604 cmd.exe 1908 cmd.exe 3528 cmd.exe 3920 cmd.exe 1784 cmd.exe 6000 cmd.exe 2564 cmd.exe 1496 cmd.exe 564 cmd.exe 5744 cmd.exe 3240 cmd.exe 5204 cmd.exe 4352 cmd.exe 2800 cmd.exe 5380 cmd.exe 2396 cmd.exe 3536 cmd.exe 5916 cmd.exe 5504 cmd.exe 3344 cmd.exe 1744 cmd.exe 5400 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5596 2672 WerFault.exe 87 3160 6112 WerFault.exe 93 1568 5700 WerFault.exe 99 2392 5416 WerFault.exe 104 1144 2148 WerFault.exe 109 5612 5536 WerFault.exe 114 4272 972 WerFault.exe 119 6060 4188 WerFault.exe 124 4532 4488 WerFault.exe 129 5856 968 WerFault.exe 134 1152 5364 WerFault.exe 139 4332 4608 WerFault.exe 144 1116 4112 WerFault.exe 149 4088 4544 WerFault.exe 154 4736 5448 WerFault.exe 159 4716 3512 WerFault.exe 164 1992 1684 WerFault.exe 169 8 2436 WerFault.exe 174 3440 5060 WerFault.exe 179 6108 4160 WerFault.exe 184 6088 4820 WerFault.exe 189 3176 5444 WerFault.exe 194 6124 3804 WerFault.exe 199 3460 264 WerFault.exe 204 4280 2508 WerFault.exe 209 3384 1488 WerFault.exe 214 3180 5344 WerFault.exe 219 1240 4092 WerFault.exe 224 2408 5620 WerFault.exe 229 3148 5044 WerFault.exe 234 984 4192 WerFault.exe 239 5848 5556 WerFault.exe 244 4612 4952 WerFault.exe 249 5440 4812 WerFault.exe 254 4976 2728 WerFault.exe 259 4736 3424 WerFault.exe 264 2252 2980 WerFault.exe 269 4324 3112 WerFault.exe 274 5452 2984 WerFault.exe 279 5396 2548 WerFault.exe 284 3632 860 WerFault.exe 289 4316 2388 WerFault.exe 294 4692 1288 WerFault.exe 299 2816 4612 WerFault.exe 304 3444 6040 WerFault.exe 309 3868 4628 WerFault.exe 314 4500 4600 WerFault.exe 319 4944 2524 WerFault.exe 324 780 1588 WerFault.exe 329 5396 620 WerFault.exe 334 2104 5864 WerFault.exe 339 5352 6108 WerFault.exe 344 2400 4916 WerFault.exe 349 2124 1536 WerFault.exe 354 2604 2220 WerFault.exe 359 3152 3456 WerFault.exe 364 1156 2648 WerFault.exe 369 6140 4384 WerFault.exe 374 5600 3348 WerFault.exe 379 5560 4284 WerFault.exe 384 3928 3412 WerFault.exe 389 3156 4104 WerFault.exe 394 5740 4412 WerFault.exe 399 1308 3188 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLEZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIRAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILTZTGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPSHMSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKDSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMGAPIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSNBMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSMNQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXFQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIJNFDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQJZOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQAJGDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPSBIWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOMGPJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe 2672 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe 6112 EEEWRY.exe 6112 EEEWRY.exe 5700 ACQI.exe 5700 ACQI.exe 5416 IKH.exe 5416 IKH.exe 2148 JNLYPEJ.exe 2148 JNLYPEJ.exe 5536 NVRY.exe 5536 NVRY.exe 972 CQBKMJF.exe 972 CQBKMJF.exe 4188 LYD.exe 4188 LYD.exe 4488 MUGLD.exe 4488 MUGLD.exe 968 GPLUFFY.exe 968 GPLUFFY.exe 5364 BCQE.exe 5364 BCQE.exe 4608 WPVVA.exe 4608 WPVVA.exe 4112 FYXA.exe 4112 FYXA.exe 4544 LYEO.exe 4544 LYEO.exe 5448 XGL.exe 5448 XGL.exe 3512 XMDD.exe 3512 XMDD.exe 1684 RHIMKB.exe 1684 RHIMKB.exe 2436 VPX.exe 2436 VPX.exe 5060 ZFDUJM.exe 5060 ZFDUJM.exe 4160 LNK.exe 4160 LNK.exe 4820 GAPMX.exe 4820 GAPMX.exe 5444 YDTH.exe 5444 YDTH.exe 3804 ZGWLQK.exe 3804 ZGWLQK.exe 264 FHE.exe 264 FHE.exe 2508 MXFQGZ.exe 2508 MXFQGZ.exe 1488 XPIJO.exe 1488 XPIJO.exe 5344 DQQ.exe 5344 DQQ.exe 4092 PILP.exe 4092 PILP.exe 5620 EDCURLN.exe 5620 EDCURLN.exe 5044 IGAPQ.exe 5044 IGAPQ.exe 4192 EMYM.exe 4192 EMYM.exe 5556 KMGAPIA.exe 5556 KMGAPIA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2672 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe 2672 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe 6112 EEEWRY.exe 6112 EEEWRY.exe 5700 ACQI.exe 5700 ACQI.exe 5416 IKH.exe 5416 IKH.exe 2148 JNLYPEJ.exe 2148 JNLYPEJ.exe 5536 NVRY.exe 5536 NVRY.exe 972 CQBKMJF.exe 972 CQBKMJF.exe 4188 LYD.exe 4188 LYD.exe 4488 MUGLD.exe 4488 MUGLD.exe 968 GPLUFFY.exe 968 GPLUFFY.exe 5364 BCQE.exe 5364 BCQE.exe 4608 WPVVA.exe 4608 WPVVA.exe 4112 FYXA.exe 4112 FYXA.exe 4544 LYEO.exe 4544 LYEO.exe 5448 XGL.exe 5448 XGL.exe 3512 XMDD.exe 3512 XMDD.exe 1684 RHIMKB.exe 1684 RHIMKB.exe 2436 VPX.exe 2436 VPX.exe 5060 ZFDUJM.exe 5060 ZFDUJM.exe 4160 LNK.exe 4160 LNK.exe 4820 GAPMX.exe 4820 GAPMX.exe 5444 YDTH.exe 5444 YDTH.exe 3804 ZGWLQK.exe 3804 ZGWLQK.exe 264 FHE.exe 264 FHE.exe 2508 MXFQGZ.exe 2508 MXFQGZ.exe 1488 XPIJO.exe 1488 XPIJO.exe 5344 DQQ.exe 5344 DQQ.exe 4092 PILP.exe 4092 PILP.exe 5620 EDCURLN.exe 5620 EDCURLN.exe 5044 IGAPQ.exe 5044 IGAPQ.exe 4192 EMYM.exe 4192 EMYM.exe 5556 KMGAPIA.exe 5556 KMGAPIA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 5380 2672 2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe 89 PID 5380 wrote to memory of 6112 5380 cmd.exe 93 PID 6112 wrote to memory of 4604 6112 EEEWRY.exe 95 PID 4604 wrote to memory of 5700 4604 cmd.exe 99 PID 5700 wrote to memory of 724 5700 ACQI.exe 100 PID 724 wrote to memory of 5416 724 cmd.exe 104 PID 5416 wrote to memory of 2796 5416 IKH.exe 105 PID 2796 wrote to memory of 2148 2796 cmd.exe 109 PID 2148 wrote to memory of 1168 2148 JNLYPEJ.exe 110 PID 1168 wrote to memory of 5536 1168 cmd.exe 114 PID 5536 wrote to memory of 1724 5536 NVRY.exe 115 PID 1724 wrote to memory of 972 1724 cmd.exe 119 PID 972 wrote to memory of 1076 972 CQBKMJF.exe 120 PID 1076 wrote to memory of 4188 1076 cmd.exe 124 PID 4188 wrote to memory of 772 4188 LYD.exe 125 PID 772 wrote to memory of 4488 772 cmd.exe 129 PID 4488 wrote to memory of 5220 4488 MUGLD.exe 130 PID 5220 wrote to memory of 968 5220 cmd.exe 134 PID 968 wrote to memory of 5568 968 GPLUFFY.exe 135 PID 5568 wrote to memory of 5364 5568 cmd.exe 139 PID 5364 wrote to memory of 1520 5364 BCQE.exe 140 PID 1520 wrote to memory of 4608 1520 cmd.exe 144 PID 4608 wrote to memory of 5548 4608 WPVVA.exe 145 PID 5548 wrote to memory of 4112 5548 cmd.exe 149 PID 4112 wrote to memory of 5204 4112 FYXA.exe 150 PID 5204 wrote to memory of 4544 5204 cmd.exe 154 PID 4544 wrote to memory of 2792 4544 LYEO.exe 155 PID 2792 wrote to memory of 5448 2792 cmd.exe 159 PID 5448 wrote to memory of 864 5448 XGL.exe 160 PID 864 wrote to memory of 3512 864 cmd.exe 164 PID 3512 wrote to memory of 5400 3512 XMDD.exe 165 PID 5400 wrote to memory of 1684 5400 cmd.exe 169 PID 1684 wrote to memory of 4816 1684 RHIMKB.exe 170 PID 4816 wrote to memory of 2436 4816 cmd.exe 174 PID 2436 wrote to memory of 5476 2436 VPX.exe 175 PID 5476 wrote to memory of 5060 5476 cmd.exe 179 PID 5060 wrote to memory of 5172 5060 ZFDUJM.exe 180 PID 5172 wrote to memory of 4160 5172 cmd.exe 184 PID 4160 wrote to memory of 5524 4160 LNK.exe 185 PID 5524 wrote to memory of 4820 5524 cmd.exe 189 PID 4820 wrote to memory of 1860 4820 GAPMX.exe 190 PID 1860 wrote to memory of 5444 1860 cmd.exe 194 PID 5444 wrote to memory of 2588 5444 YDTH.exe 195 PID 2588 wrote to memory of 3804 2588 cmd.exe 199 PID 3804 wrote to memory of 4376 3804 ZGWLQK.exe 200 PID 4376 wrote to memory of 264 4376 cmd.exe 204 PID 264 wrote to memory of 4960 264 FHE.exe 205 PID 4960 wrote to memory of 2508 4960 cmd.exe 209 PID 2508 wrote to memory of 2056 2508 MXFQGZ.exe 210 PID 2056 wrote to memory of 1488 2056 cmd.exe 214 PID 1488 wrote to memory of 1204 1488 XPIJO.exe 215 PID 1204 wrote to memory of 5344 1204 cmd.exe 219 PID 5344 wrote to memory of 2284 5344 DQQ.exe 220 PID 2284 wrote to memory of 4092 2284 cmd.exe 224 PID 4092 wrote to memory of 6004 4092 PILP.exe 225 PID 6004 wrote to memory of 5620 6004 cmd.exe 229 PID 5620 wrote to memory of 2700 5620 EDCURLN.exe 230 PID 2700 wrote to memory of 5044 2700 cmd.exe 234 PID 5044 wrote to memory of 2492 5044 IGAPQ.exe 235 PID 2492 wrote to memory of 4192 2492 cmd.exe 239 PID 4192 wrote to memory of 5248 4192 EMYM.exe 240 PID 5248 wrote to memory of 5556 5248 cmd.exe 244 PID 5556 wrote to memory of 5764 5556 KMGAPIA.exe 245 PID 5764 wrote to memory of 4952 5764 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_fc14d82bffcb79ccf47430e59376573b_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKH.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\system\IKH.exeC:\windows\system\IKH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNLYPEJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\SysWOW64\JNLYPEJ.exeC:\windows\system32\JNLYPEJ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVRY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\SysWOW64\NVRY.exeC:\windows\system32\NVRY.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYD.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\system\LYD.exeC:\windows\system\LYD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUGLD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\windows\system\MUGLD.exeC:\windows\system\MUGLD.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPLUFFY.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\SysWOW64\GPLUFFY.exeC:\windows\system32\GPLUFFY.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCQE.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\SysWOW64\BCQE.exeC:\windows\system32\BCQE.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPVVA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\SysWOW64\WPVVA.exeC:\windows\system32\WPVVA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\XGL.exeC:\windows\XGL.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\XMDD.exeC:\windows\XMDD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPX.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\SysWOW64\VPX.exeC:\windows\system32\VPX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFDUJM.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\ZFDUJM.exeC:\windows\ZFDUJM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\windows\LNK.exeC:\windows\LNK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\YDTH.exeC:\windows\YDTH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGWLQK.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\SysWOW64\ZGWLQK.exeC:\windows\system32\ZGWLQK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\windows\FHE.exeC:\windows\FHE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPIJO.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\windows\XPIJO.exeC:\windows\XPIJO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDCURLN.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\EDCURLN.exeC:\windows\EDCURLN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe65⤵
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "66⤵PID:5552
-
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe67⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFSLJP.exe.bat" "68⤵PID:2752
-
C:\windows\system\LFSLJP.exeC:\windows\system\LFSLJP.exe69⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "70⤵PID:1616
-
C:\windows\FTX.exeC:\windows\FTX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "72⤵PID:2464
-
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe73⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRK.exe.bat" "74⤵PID:5412
-
C:\windows\system\VRK.exeC:\windows\system\VRK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2872 -
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKVJJJB.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2396 -
C:\windows\MKVJJJB.exeC:\windows\MKVJJJB.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4352 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe81⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXVLU.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1908 -
C:\windows\system\SXVLU.exeC:\windows\system\SXVLU.exe83⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "84⤵PID:4200
-
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe85⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQAJGDW.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\windows\NQAJGDW.exeC:\windows\NQAJGDW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "88⤵PID:2824
-
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DONJEGG.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\windows\SysWOW64\DONJEGG.exeC:\windows\system32\DONJEGG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "92⤵PID:1572
-
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "94⤵PID:1432
-
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXZP.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1992 -
C:\windows\BXZP.exeC:\windows\BXZP.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3324 -
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NYORUH.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5100 -
C:\windows\NYORUH.exeC:\windows\NYORUH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "102⤵PID:4532
-
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "104⤵PID:2932
-
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "106⤵PID:2820
-
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKDSY.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4800 -
C:\windows\MKDSY.exeC:\windows\MKDSY.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIJNFDM.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4168 -
C:\windows\SysWOW64\WIJNFDM.exeC:\windows\system32\WIJNFDM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIRAW.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3528 -
C:\windows\UIRAW.exeC:\windows\UIRAW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LITFZC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\windows\SysWOW64\LITFZC.exeC:\windows\system32\LITFZC.exe115⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "116⤵PID:3604
-
C:\windows\system\RJA.exeC:\windows\system\RJA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITR.exe.bat" "118⤵PID:1200
-
C:\windows\SysWOW64\ITR.exeC:\windows\system32\ITR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "120⤵PID:5096
-
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-