Analysis
- max time kernel
90s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe
- Size 208KB
- Sample260820-p9wpwsde56
- SHA256 2639249ce28b2a9fffa901396cc7cee2f8ec71f6df37402b336983c4ca817f64
- MD5 2c86c58bb30e5737a10eb6ec5801d3ff
- SHA1 c36374b902539d285a9fce2c50225325c6992118
- SHA512 6ac6a72c9e730c8bb0c22ddddd92f29f3cf3923560ae1b800b26851a6b6f69ed0842de316c395354f7bdc1241a314095b31b88a28f0965532cc467c67f646239
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfK4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOykEj1
- TLSH T164247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 796 YLOOZ.exe 3868 LHH.exe 6048 FUMFT.exe 4364 JKSNGBZ.exe 4676 TIYI.exe 3956 MLK.exe 5832 MGNHG.exe 2916 JLYWWL.exe 3060 KOB.exe 6108 MMPNJJY.exe 5320 QPNIR.exe 2448 UFU.exe 4752 WSZR.exe 204 ABFRSMZ.exe 1616 QRGQY.exe 3920 BRW.exe 4132 VEBLS.exe 3712 WZEP.exe 3688 PCIKLO.exe 1432 EXSX.exe 4796 PQVHE.exe 5496 BGBPIBH.exe 2624 BMB.exe 1128 QHLIDB.exe 236 GXMI.exe 1872 ASRRUW.exe 4180 TNU.exe 4564 OIZWJ.exe 4688 IWEGML.exe 2068 DYMEAO.exe 1184 YUR.exe 4192 HUTBO.exe 4468 WPDFHGW.exe 1780 EDD.exe 4328 CDLHR.exe 4828 FQPRBNP.exe 3220 ORR.exe 3352 YOX.exe 3788 RRBMA.exe 1612 BPGG.exe 5024 USSKNP.exe 1848 OGP.exe 4640 DBGYIK.exe 2436 HEFT.exe 3184 XHOXBQM.exe 3388 XCSB.exe 4880 BSZ.exe 5616 KSBG.exe 1520 QSITNYM.exe 2704 RVM.exe 4252 MJRHD.exe 3928 XBUZDV.exe 3300 QEY.exe 3840 TMEDDD.exe 3864 NFHODSF.exe 5764 LFPC.exe 5812 HLNZBW.exe 1048 HQNNDJL.exe 3932 ITR.exe 5224 VEH.exe 4144 ZMOQIU.exe 2076 CZT.exe 3364 CNL.exe 5716 LSVG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\DBGYIK.exe OGP.exe File opened for modification C:\windows\SysWOW64\ITR.exe HQNNDJL.exe File created C:\windows\SysWOW64\ITR.exe.bat HQNNDJL.exe File created C:\windows\SysWOW64\SNLQF.exe HUIX.exe File opened for modification C:\windows\SysWOW64\HHWT.exe VZQTBI.exe File created C:\windows\SysWOW64\WQGUHAZ.exe RQYYQ.exe File created C:\windows\SysWOW64\BXVOFA.exe GKQWU.exe File created C:\windows\SysWOW64\ZCAOB.exe HZWKVAW.exe File opened for modification C:\windows\SysWOW64\HUIX.exe FHDONKL.exe File opened for modification C:\windows\SysWOW64\VZQTBI.exe TCCYTAY.exe File opened for modification C:\windows\SysWOW64\ABFRSMZ.exe WSZR.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\BRW.exe QRGQY.exe File created C:\windows\SysWOW64\PCIKLO.exe.bat WZEP.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe QEY.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat QEY.exe File created C:\windows\SysWOW64\ZCAOB.exe.bat HZWKVAW.exe File created C:\windows\SysWOW64\FHDONKL.exe.bat DJY.exe File created C:\windows\SysWOW64\HUIX.exe.bat FHDONKL.exe File opened for modification C:\windows\SysWOW64\WQGUHAZ.exe RQYYQ.exe File created C:\windows\SysWOW64\BRW.exe QRGQY.exe File created C:\windows\SysWOW64\VEBLS.exe.bat BRW.exe File created C:\windows\SysWOW64\NFHODSF.exe.bat TMEDDD.exe File created C:\windows\SysWOW64\EKA.exe.bat BXVOFA.exe File created C:\windows\SysWOW64\ZIRIROO.exe.bat PIP.exe File created C:\windows\SysWOW64\LHH.exe.bat YLOOZ.exe File created C:\windows\SysWOW64\TNU.exe ASRRUW.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat OGP.exe File created C:\windows\SysWOW64\TMEDDD.exe QEY.exe File created C:\windows\SysWOW64\NFHODSF.exe TMEDDD.exe File opened for modification C:\windows\SysWOW64\HLNZBW.exe LFPC.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat GWGYYV.exe File opened for modification C:\windows\SysWOW64\NJOA.exe WAM.exe File opened for modification C:\windows\SysWOW64\LHH.exe YLOOZ.exe File created C:\windows\SysWOW64\TNU.exe.bat ASRRUW.exe File opened for modification C:\windows\SysWOW64\HUTBO.exe YUR.exe File created C:\windows\SysWOW64\QEY.exe.bat XBUZDV.exe File created C:\windows\SysWOW64\HLNZBW.exe.bat LFPC.exe File opened for modification C:\windows\SysWOW64\NTADWQT.exe WLYYK.exe File opened for modification C:\windows\SysWOW64\WAM.exe QAEIY.exe File opened for modification C:\windows\SysWOW64\TCCYTAY.exe ZOXPJ.exe File created C:\windows\SysWOW64\ABFRSMZ.exe WSZR.exe File created C:\windows\SysWOW64\VEBLS.exe BRW.exe File created C:\windows\SysWOW64\RRBMA.exe YOX.exe File opened for modification C:\windows\SysWOW64\RRBMA.exe YOX.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat WLYYK.exe File created C:\windows\SysWOW64\TCCYTAY.exe ZOXPJ.exe File created C:\windows\SysWOW64\VZQTBI.exe.bat TCCYTAY.exe File created C:\windows\SysWOW64\RQYYQ.exe.bat HHWT.exe File created C:\windows\SysWOW64\FUMFT.exe LHH.exe File created C:\windows\SysWOW64\PCIKLO.exe WZEP.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe HZWKVAW.exe File created C:\windows\SysWOW64\NJOA.exe.bat WAM.exe File opened for modification C:\windows\SysWOW64\SNLQF.exe HUIX.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat ZOXPJ.exe File created C:\windows\SysWOW64\VZQTBI.exe TCCYTAY.exe File created C:\windows\SysWOW64\LHH.exe YLOOZ.exe File created C:\windows\SysWOW64\WSZR.exe.bat UFU.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe BRW.exe File created C:\windows\SysWOW64\QEY.exe XBUZDV.exe File created C:\windows\SysWOW64\ITR.exe HQNNDJL.exe File created C:\windows\SysWOW64\WAM.exe.bat QAEIY.exe File created C:\windows\SysWOW64\FHDONKL.exe DJY.exe File created C:\windows\SysWOW64\HHWT.exe VZQTBI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\VEH.exe.bat ITR.exe File created C:\windows\DUKWI.exe ZMD.exe File created C:\windows\system\IAHXTS.exe.bat EKA.exe File opened for modification C:\windows\system\BAWINO.exe SNLQF.exe File created C:\windows\MLK.exe TIYI.exe File opened for modification C:\windows\YOX.exe ORR.exe File opened for modification C:\windows\GWGYYV.exe IAHXTS.exe File created C:\windows\system\JFGPSM.exe.bat FXZPFT.exe File created C:\windows\system\QAEIY.exe.bat WNAQ.exe File created C:\windows\system\PQVHE.exe EXSX.exe File created C:\windows\DZKSXYE.exe.bat GTM.exe File opened for modification C:\windows\QRGQY.exe ABFRSMZ.exe File opened for modification C:\windows\system\GKQWU.exe DUKWI.exe File opened for modification C:\windows\system\IAHXTS.exe EKA.exe File created C:\windows\GWGYYV.exe.bat IAHXTS.exe File created C:\windows\system\ANGRC.exe.bat GSBI.exe File created C:\windows\ZVYEPFJ.exe.bat NDDMH.exe File created C:\windows\system\JLYWWL.exe.bat MGNHG.exe File created C:\windows\system\BMB.exe BGBPIBH.exe File created C:\windows\system\AAMVSNG.exe AXIR.exe File created C:\windows\QRGQY.exe.bat ABFRSMZ.exe File opened for modification C:\windows\system\CDLHR.exe EDD.exe File created C:\windows\system\ORR.exe.bat FQPRBNP.exe File created C:\windows\system\LFPC.exe NFHODSF.exe File created C:\windows\BSZ.exe.bat XCSB.exe File created C:\windows\system\WZEP.exe.bat VEBLS.exe File created C:\windows\system\CDLHR.exe.bat EDD.exe File created C:\windows\system\QSITNYM.exe KSBG.exe File created C:\windows\UFU.exe.bat QPNIR.exe File created C:\windows\QHLIDB.exe.bat BMB.exe File created C:\windows\system\ORR.exe FQPRBNP.exe File created C:\windows\system\MJRHD.exe.bat RVM.exe File created C:\windows\XBUZDV.exe.bat MJRHD.exe File opened for modification C:\windows\WLYYK.exe LSVG.exe File created C:\windows\TEW.exe ZIRIROO.exe File opened for modification C:\windows\system\IWTKVC.exe NJOA.exe File opened for modification C:\windows\FWR.exe TEW.exe File created C:\windows\AXIR.exe UXBDWV.exe File opened for modification C:\windows\system\AAMVSNG.exe AXIR.exe File created C:\windows\MGNHG.exe MLK.exe File created C:\windows\BGBPIBH.exe PQVHE.exe File created C:\windows\OGP.exe.bat USSKNP.exe File created C:\windows\RDDD.exe WQGUHAZ.exe File created C:\windows\MMPNJJY.exe KOB.exe File created C:\windows\YLOOZ.exe 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe File created C:\windows\MGNHG.exe.bat MLK.exe File created C:\windows\IWEGML.exe OIZWJ.exe File created C:\windows\FXZPFT.exe.bat ZCAOB.exe File created C:\windows\system\EXSX.exe.bat PCIKLO.exe File created C:\windows\CGOWWBG.exe BAWINO.exe File opened for modification C:\windows\MMPNJJY.exe KOB.exe File opened for modification C:\windows\BPGG.exe RRBMA.exe File opened for modification C:\windows\system\JFGPSM.exe FXZPFT.exe File opened for modification C:\windows\system\KWZYS.exe FWR.exe File created C:\windows\system\NDDMH.exe AAMVSNG.exe File created C:\windows\TIYI.exe.bat JKSNGBZ.exe File opened for modification C:\windows\system\WZEP.exe VEBLS.exe File created C:\windows\IWEGML.exe.bat OIZWJ.exe File created C:\windows\system\LFPC.exe.bat NFHODSF.exe File created C:\windows\GEQXT.exe MRL.exe File created C:\windows\system\PQVHE.exe.bat EXSX.exe File created C:\windows\WLYYK.exe.bat LSVG.exe File opened for modification C:\windows\FXZPFT.exe ZCAOB.exe File created C:\windows\system\BAWINO.exe SNLQF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3672 cmd.exe 5476 cmd.exe 4852 cmd.exe 1976 cmd.exe 1444 cmd.exe 2408 cmd.exe 2340 cmd.exe 2148 cmd.exe 4556 cmd.exe 4648 cmd.exe 5572 cmd.exe 1552 cmd.exe 5792 cmd.exe 5232 cmd.exe 4404 cmd.exe 3420 cmd.exe 4056 cmd.exe 3508 cmd.exe 2516 cmd.exe 4872 cmd.exe 1764 cmd.exe 3848 cmd.exe 704 cmd.exe 2108 cmd.exe 6024 cmd.exe 4748 cmd.exe 5712 cmd.exe 4924 cmd.exe 4256 cmd.exe 5656 cmd.exe 2888 cmd.exe 3736 cmd.exe 2344 cmd.exe 1428 cmd.exe 1140 cmd.exe 3120 cmd.exe 5768 cmd.exe 4348 cmd.exe 2008 cmd.exe 2756 cmd.exe 2468 cmd.exe 4812 cmd.exe 2708 cmd.exe 4316 cmd.exe 2532 cmd.exe 5804 cmd.exe 3656 cmd.exe 4432 cmd.exe 5980 cmd.exe 5400 cmd.exe 4864 cmd.exe 4496 cmd.exe 3292 cmd.exe 2952 cmd.exe 936 cmd.exe 1628 cmd.exe 5708 cmd.exe 4724 cmd.exe 2884 cmd.exe 2812 cmd.exe 1860 cmd.exe 3260 cmd.exe 3000 cmd.exe 2612 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4476 2964 WerFault.exe 87 2100 796 WerFault.exe 93 824 3868 WerFault.exe 98 5700 6048 WerFault.exe 104 6080 4364 WerFault.exe 109 1060 4676 WerFault.exe 114 4748 3956 WerFault.exe 119 3440 5832 WerFault.exe 124 4324 2916 WerFault.exe 129 4240 3060 WerFault.exe 134 3208 6108 WerFault.exe 139 2452 5320 WerFault.exe 144 5688 2448 WerFault.exe 149 6020 4752 WerFault.exe 154 3940 204 WerFault.exe 159 2088 1616 WerFault.exe 164 2664 3920 WerFault.exe 169 828 4132 WerFault.exe 174 3912 3712 WerFault.exe 179 3456 3688 WerFault.exe 184 716 1432 WerFault.exe 189 3248 4796 WerFault.exe 194 1780 5496 WerFault.exe 199 3720 2624 WerFault.exe 204 256 1128 WerFault.exe 209 3476 236 WerFault.exe 214 3496 1872 WerFault.exe 219 2660 4180 WerFault.exe 224 900 4564 WerFault.exe 229 1108 4688 WerFault.exe 234 5628 2068 WerFault.exe 239 3344 1184 WerFault.exe 244 1356 4192 WerFault.exe 249 5596 4468 WerFault.exe 254 5872 1780 WerFault.exe 259 5988 4328 WerFault.exe 264 4084 4828 WerFault.exe 269 6056 3220 WerFault.exe 274 3348 3352 WerFault.exe 280 1500 3788 WerFault.exe 285 3912 1612 WerFault.exe 290 1028 5024 WerFault.exe 295 5100 1848 WerFault.exe 300 2548 4640 WerFault.exe 305 2556 2436 WerFault.exe 310 3288 3184 WerFault.exe 315 4184 3388 WerFault.exe 320 3776 4880 WerFault.exe 325 1548 5616 WerFault.exe 330 4792 1520 WerFault.exe 335 2888 2704 WerFault.exe 340 5708 4252 WerFault.exe 345 4840 3928 WerFault.exe 350 4124 3300 WerFault.exe 355 784 3840 WerFault.exe 360 4724 3864 WerFault.exe 365 6080 5764 WerFault.exe 370 4776 5812 WerFault.exe 375 4108 1048 WerFault.exe 380 3608 3932 WerFault.exe 385 3456 5224 WerFault.exe 390 3380 4144 WerFault.exe 395 4388 2076 WerFault.exe 400 3720 3364 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEMGKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHLIDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USSKNP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHDONKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMEDDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLYYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGUHAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPNIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYMEAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQYYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASRRUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDLHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGNHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLNZBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXBDWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAMVSNG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2964 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe 2964 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe 796 YLOOZ.exe 796 YLOOZ.exe 3868 LHH.exe 3868 LHH.exe 6048 FUMFT.exe 6048 FUMFT.exe 4364 JKSNGBZ.exe 4364 JKSNGBZ.exe 4676 TIYI.exe 4676 TIYI.exe 3956 MLK.exe 3956 MLK.exe 5832 MGNHG.exe 5832 MGNHG.exe 2916 JLYWWL.exe 2916 JLYWWL.exe 3060 KOB.exe 3060 KOB.exe 6108 MMPNJJY.exe 6108 MMPNJJY.exe 5320 QPNIR.exe 5320 QPNIR.exe 2448 UFU.exe 2448 UFU.exe 4752 WSZR.exe 4752 WSZR.exe 204 ABFRSMZ.exe 204 ABFRSMZ.exe 1616 QRGQY.exe 1616 QRGQY.exe 3920 BRW.exe 3920 BRW.exe 4132 VEBLS.exe 4132 VEBLS.exe 3712 WZEP.exe 3712 WZEP.exe 3688 PCIKLO.exe 3688 PCIKLO.exe 1432 EXSX.exe 1432 EXSX.exe 4796 PQVHE.exe 4796 PQVHE.exe 5496 BGBPIBH.exe 5496 BGBPIBH.exe 2624 BMB.exe 2624 BMB.exe 1128 QHLIDB.exe 1128 QHLIDB.exe 236 GXMI.exe 236 GXMI.exe 1872 ASRRUW.exe 1872 ASRRUW.exe 4180 TNU.exe 4180 TNU.exe 4564 OIZWJ.exe 4564 OIZWJ.exe 4688 IWEGML.exe 4688 IWEGML.exe 2068 DYMEAO.exe 2068 DYMEAO.exe 1184 YUR.exe 1184 YUR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2964 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe 2964 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe 796 YLOOZ.exe 796 YLOOZ.exe 3868 LHH.exe 3868 LHH.exe 6048 FUMFT.exe 6048 FUMFT.exe 4364 JKSNGBZ.exe 4364 JKSNGBZ.exe 4676 TIYI.exe 4676 TIYI.exe 3956 MLK.exe 3956 MLK.exe 5832 MGNHG.exe 5832 MGNHG.exe 2916 JLYWWL.exe 2916 JLYWWL.exe 3060 KOB.exe 3060 KOB.exe 6108 MMPNJJY.exe 6108 MMPNJJY.exe 5320 QPNIR.exe 5320 QPNIR.exe 2448 UFU.exe 2448 UFU.exe 4752 WSZR.exe 4752 WSZR.exe 204 ABFRSMZ.exe 204 ABFRSMZ.exe 1616 QRGQY.exe 1616 QRGQY.exe 3920 BRW.exe 3920 BRW.exe 4132 VEBLS.exe 4132 VEBLS.exe 3712 WZEP.exe 3712 WZEP.exe 3688 PCIKLO.exe 3688 PCIKLO.exe 1432 EXSX.exe 1432 EXSX.exe 4796 PQVHE.exe 4796 PQVHE.exe 5496 BGBPIBH.exe 5496 BGBPIBH.exe 2624 BMB.exe 2624 BMB.exe 1128 QHLIDB.exe 1128 QHLIDB.exe 236 GXMI.exe 236 GXMI.exe 1872 ASRRUW.exe 1872 ASRRUW.exe 4180 TNU.exe 4180 TNU.exe 4564 OIZWJ.exe 4564 OIZWJ.exe 4688 IWEGML.exe 4688 IWEGML.exe 2068 DYMEAO.exe 2068 DYMEAO.exe 1184 YUR.exe 1184 YUR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 936 2964 2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe 89 PID 936 wrote to memory of 796 936 cmd.exe 93 PID 796 wrote to memory of 4088 796 YLOOZ.exe 95 PID 4088 wrote to memory of 3868 4088 cmd.exe 98 PID 3868 wrote to memory of 52 3868 LHH.exe 100 PID 52 wrote to memory of 6048 52 cmd.exe 104 PID 6048 wrote to memory of 5880 6048 FUMFT.exe 105 PID 5880 wrote to memory of 4364 5880 cmd.exe 109 PID 4364 wrote to memory of 4596 4364 JKSNGBZ.exe 110 PID 4596 wrote to memory of 4676 4596 cmd.exe 114 PID 4676 wrote to memory of 5980 4676 TIYI.exe 115 PID 5980 wrote to memory of 3956 5980 cmd.exe 119 PID 3956 wrote to memory of 476 3956 MLK.exe 120 PID 476 wrote to memory of 5832 476 cmd.exe 124 PID 5832 wrote to memory of 1456 5832 MGNHG.exe 125 PID 1456 wrote to memory of 2916 1456 cmd.exe 129 PID 2916 wrote to memory of 4056 2916 JLYWWL.exe 130 PID 4056 wrote to memory of 3060 4056 cmd.exe 134 PID 3060 wrote to memory of 2428 3060 KOB.exe 135 PID 2428 wrote to memory of 6108 2428 cmd.exe 139 PID 6108 wrote to memory of 4648 6108 MMPNJJY.exe 140 PID 4648 wrote to memory of 5320 4648 cmd.exe 144 PID 5320 wrote to memory of 5444 5320 QPNIR.exe 145 PID 5444 wrote to memory of 2448 5444 cmd.exe 149 PID 2448 wrote to memory of 4628 2448 UFU.exe 150 PID 4628 wrote to memory of 4752 4628 cmd.exe 154 PID 4752 wrote to memory of 5948 4752 WSZR.exe 155 PID 5948 wrote to memory of 204 5948 cmd.exe 159 PID 204 wrote to memory of 5588 204 ABFRSMZ.exe 160 PID 5588 wrote to memory of 1616 5588 cmd.exe 164 PID 1616 wrote to memory of 1300 1616 QRGQY.exe 165 PID 1300 wrote to memory of 3920 1300 cmd.exe 169 PID 3920 wrote to memory of 1084 3920 BRW.exe 170 PID 1084 wrote to memory of 4132 1084 cmd.exe 174 PID 4132 wrote to memory of 2568 4132 VEBLS.exe 175 PID 2568 wrote to memory of 3712 2568 cmd.exe 179 PID 3712 wrote to memory of 4276 3712 WZEP.exe 180 PID 4276 wrote to memory of 3688 4276 cmd.exe 184 PID 3688 wrote to memory of 1568 3688 PCIKLO.exe 185 PID 1568 wrote to memory of 1432 1568 cmd.exe 189 PID 1432 wrote to memory of 5400 1432 EXSX.exe 190 PID 5400 wrote to memory of 4796 5400 cmd.exe 194 PID 4796 wrote to memory of 2632 4796 PQVHE.exe 195 PID 2632 wrote to memory of 5496 2632 cmd.exe 199 PID 5496 wrote to memory of 928 5496 BGBPIBH.exe 200 PID 928 wrote to memory of 2624 928 cmd.exe 204 PID 2624 wrote to memory of 1196 2624 BMB.exe 205 PID 1196 wrote to memory of 1128 1196 cmd.exe 209 PID 1128 wrote to memory of 3764 1128 QHLIDB.exe 210 PID 3764 wrote to memory of 236 3764 cmd.exe 214 PID 236 wrote to memory of 4652 236 GXMI.exe 215 PID 4652 wrote to memory of 1872 4652 cmd.exe 219 PID 1872 wrote to memory of 6024 1872 ASRRUW.exe 220 PID 6024 wrote to memory of 4180 6024 cmd.exe 224 PID 4180 wrote to memory of 3376 4180 TNU.exe 225 PID 3376 wrote to memory of 4564 3376 cmd.exe 229 PID 4564 wrote to memory of 1060 4564 OIZWJ.exe 230 PID 1060 wrote to memory of 4688 1060 cmd.exe 234 PID 4688 wrote to memory of 4748 4688 IWEGML.exe 235 PID 4748 wrote to memory of 2068 4748 cmd.exe 239 PID 2068 wrote to memory of 4092 2068 DYMEAO.exe 240 PID 4092 wrote to memory of 1184 4092 cmd.exe 244 PID 1184 wrote to memory of 5876 1184 YUR.exe 245 PID 5876 wrote to memory of 4192 5876 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2c86c58bb30e5737a10eb6ec5801d3ff_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLOOZ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\YLOOZ.exeC:\windows\YLOOZ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LHH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\SysWOW64\LHH.exeC:\windows\system32\LHH.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUMFT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\SysWOW64\FUMFT.exeC:\windows\system32\FUMFT.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKSNGBZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\JKSNGBZ.exeC:\windows\JKSNGBZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIYI.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\TIYI.exeC:\windows\TIYI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\MLK.exeC:\windows\MLK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\MGNHG.exeC:\windows\MGNHG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOB.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\KOB.exeC:\windows\KOB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MMPNJJY.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\MMPNJJY.exeC:\windows\MMPNJJY.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPNIR.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\QPNIR.exeC:\windows\QPNIR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\windows\UFU.exeC:\windows\UFU.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSZR.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\SysWOW64\WSZR.exeC:\windows\system32\WSZR.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABFRSMZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\SysWOW64\ABFRSMZ.exeC:\windows\system32\ABFRSMZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXSX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\system\EXSX.exeC:\windows\system\EXSX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\windows\system\BMB.exeC:\windows\system\BMB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QHLIDB.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\QHLIDB.exeC:\windows\QHLIDB.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNU.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\SysWOW64\TNU.exeC:\windows\system32\TNU.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYMEAO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\SysWOW64\DYMEAO.exeC:\windows\system32\DYMEAO.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\YUR.exeC:\windows\YUR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe65⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPDFHGW.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2708 -
C:\windows\WPDFHGW.exeC:\windows\WPDFHGW.exe67⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDD.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\EDD.exeC:\windows\EDD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "72⤵PID:1728
-
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "74⤵PID:1204
-
C:\windows\system\ORR.exeC:\windows\system\ORR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "76⤵PID:3496
-
C:\windows\YOX.exeC:\windows\YOX.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5572 -
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPGG.exe.bat" "80⤵PID:1172
-
C:\windows\BPGG.exeC:\windows\BPGG.exe81⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USSKNP.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\windows\system\USSKNP.exeC:\windows\system\USSKNP.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\OGP.exeC:\windows\OGP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "86⤵PID:5340
-
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe87⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFT.exe.bat" "88⤵PID:4460
-
C:\windows\system\HEFT.exeC:\windows\system\HEFT.exe89⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOXBQM.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\windows\XHOXBQM.exeC:\windows\XHOXBQM.exe91⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3272 -
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3508 -
C:\windows\BSZ.exeC:\windows\BSZ.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1428 -
C:\windows\KSBG.exeC:\windows\KSBG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSITNYM.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5712 -
C:\windows\system\QSITNYM.exeC:\windows\system\QSITNYM.exe99⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVM.exe.bat" "100⤵PID:2720
-
C:\windows\system\RVM.exeC:\windows\system\RVM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MJRHD.exe.bat" "102⤵PID:4904
-
C:\windows\system\MJRHD.exeC:\windows\system\MJRHD.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBUZDV.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\XBUZDV.exeC:\windows\XBUZDV.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEY.exe.bat" "106⤵PID:3372
-
C:\windows\SysWOW64\QEY.exeC:\windows\system32\QEY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "108⤵PID:2912
-
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFHODSF.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3000 -
C:\windows\SysWOW64\NFHODSF.exeC:\windows\system32\NFHODSF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFPC.exe.bat" "112⤵PID:1352
-
C:\windows\system\LFPC.exeC:\windows\system\LFPC.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLNZBW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2516 -
C:\windows\SysWOW64\HLNZBW.exeC:\windows\system32\HLNZBW.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4872 -
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITR.exe.bat" "118⤵PID:4064
-
C:\windows\SysWOW64\ITR.exeC:\windows\system32\ITR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "120⤵PID:2572
-
C:\windows\VEH.exeC:\windows\VEH.exe121⤵
- Executes dropped EXE
PID:5224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-