Analysis
- max time kernel
97s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe
- Size 208KB
- Sample260822-e7q2hseq7s
- SHA256 d44fe37fc0950ac8b79d2a1998a7b717f9bf075531fe4005e732337e85dc297b
- MD5 2092c3680678c802b4ecb7f537b85786
- SHA1 bd26a4d9612a19fed1c2c17d9f9a58820bad917b
- SHA512 a89db264ea618c2369ee4264983fb02eba3f438f5c81bb51e1494ad7c73016bc18d28666854259ce73f6df37d84d2a1a480decd31dc3a6c2beb770c1bd8bfd2a
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfj4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LOrkEj1
- TLSH T1E4247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1520 JZZOQL.exe 6416 SXGHL.exe 3492 INH.exe 6352 ZTRY.exe 3308 YDC.exe 6768 MJAEX.exe 3628 DRCRAG.exe 4596 PKFBJVK.exe 5388 JXKL.exe 5644 NFRTXFV.exe 6996 KLW.exe 2676 COAMS.exe 6444 IOIZBHA.exe 4244 JRMD.exe 6292 UKPWOE.exe 4616 PXLFZEF.exe 3820 LDRU.exe 5700 TIEJ.exe 2872 RILXZP.exe 6588 XELYESU.exe 3968 NZUCP.exe 5860 TUTDUHS.exe 1276 IPD.exe 964 RPFUQAV.exe 4800 SSJ.exe 5492 KWMTBFF.exe 7064 FJRD.exe 6472 AWWMWF.exe 1600 RJGELCX.exe 6040 RPZTNPA.exe 2224 ICJLD.exe 4272 TVMEDT.exe 6424 OIR.exe 4944 ZBUGWIH.exe 6928 IJWLZF.exe 5540 FHUIG.exe 4532 SRKHU.exe 6616 NFPQFSN.exe 4220 ENJ.exe 6720 KNRJRR.exe 1784 KTRXBE.exe 4336 ZOAC.exe 2376 UJFLWR.exe 7088 UPFAXEM.exe 6392 JKPMI.exe 1272 EXTVTQ.exe 4320 NVZI.exe 1904 ZNCAI.exe 2936 FOKORII.exe 1712 FTK.exe 3020 KUJQK.exe 1268 HZPNR.exe 3016 HFQCSM.exe 2984 YSAU.exe 3980 YYSI.exe 5060 VDYGRY.exe 4228 BDGTIA.exe 6556 GOKSNRY.exe 5132 RHFK.exe 1072 VPLLZR.exe 4864 XNMNGGJ.exe 6776 SAR.exe 1288 OGP.exe 6012 UGXHG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\TUTDUHS.exe NZUCP.exe File opened for modification C:\windows\SysWOW64\URGXOH.exe TDOJN.exe File created C:\windows\SysWOW64\YYSI.exe.bat YSAU.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat CDVF.exe File created C:\windows\SysWOW64\JRMD.exe IOIZBHA.exe File created C:\windows\SysWOW64\XEMUW.exe.bat DQH.exe File created C:\windows\SysWOW64\OCPHPQT.exe.bat FCNCEK.exe File opened for modification C:\windows\SysWOW64\NFRTXFV.exe JXKL.exe File created C:\windows\SysWOW64\OIR.exe TVMEDT.exe File created C:\windows\SysWOW64\EXTVTQ.exe.bat JKPMI.exe File created C:\windows\SysWOW64\SAR.exe.bat XNMNGGJ.exe File created C:\windows\SysWOW64\OCPHPQT.exe FCNCEK.exe File opened for modification C:\windows\SysWOW64\OCPHPQT.exe FCNCEK.exe File created C:\windows\SysWOW64\MJAEX.exe YDC.exe File created C:\windows\SysWOW64\NFRTXFV.exe JXKL.exe File created C:\windows\SysWOW64\ZBUGWIH.exe.bat OIR.exe File created C:\windows\SysWOW64\ZNCAI.exe NVZI.exe File created C:\windows\SysWOW64\TDOJN.exe.bat VOVGSPA.exe File opened for modification C:\windows\SysWOW64\TQIWLXI.exe IYFDD.exe File created C:\windows\SysWOW64\RHFK.exe.bat GOKSNRY.exe File created C:\windows\SysWOW64\SAR.exe XNMNGGJ.exe File created C:\windows\SysWOW64\PKFBJVK.exe DRCRAG.exe File opened for modification C:\windows\SysWOW64\ZBUGWIH.exe OIR.exe File created C:\windows\SysWOW64\SRKHU.exe FHUIG.exe File created C:\windows\SysWOW64\KNRJRR.exe ENJ.exe File opened for modification C:\windows\SysWOW64\IKFR.exe GMMXIB.exe File created C:\windows\SysWOW64\ARHO.exe URZS.exe File created C:\windows\SysWOW64\TDOJN.exe VOVGSPA.exe File created C:\windows\SysWOW64\TQIWLXI.exe.bat IYFDD.exe File created C:\windows\SysWOW64\XJEAYG.exe XEMUW.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat PQBMIK.exe File created C:\windows\SysWOW64\XYN.exe.bat CKIDILB.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe THRW.exe File created C:\windows\SysWOW64\RPZTNPA.exe.bat RJGELCX.exe File opened for modification C:\windows\SysWOW64\YDC.exe ZTRY.exe File created C:\windows\SysWOW64\PKFBJVK.exe.bat DRCRAG.exe File opened for modification C:\windows\SysWOW64\RPZTNPA.exe RJGELCX.exe File opened for modification C:\windows\SysWOW64\SAR.exe XNMNGGJ.exe File created C:\windows\SysWOW64\IYFDD.exe ZQDY.exe File created C:\windows\SysWOW64\DRCRAG.exe MJAEX.exe File created C:\windows\SysWOW64\ZWDJAGY.exe FJYAQG.exe File opened for modification C:\windows\SysWOW64\ZWDJAGY.exe FJYAQG.exe File created C:\windows\SysWOW64\GOKSNRY.exe BDGTIA.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe BDGTIA.exe File created C:\windows\SysWOW64\ZWDJAGY.exe.bat FJYAQG.exe File opened for modification C:\windows\SysWOW64\JRMD.exe IOIZBHA.exe File opened for modification C:\windows\SysWOW64\OIR.exe TVMEDT.exe File created C:\windows\SysWOW64\TUTDUHS.exe NZUCP.exe File opened for modification C:\windows\SysWOW64\HZPNR.exe KUJQK.exe File created C:\windows\SysWOW64\JRMD.exe.bat IOIZBHA.exe File created C:\windows\SysWOW64\KUJQK.exe.bat FTK.exe File created C:\windows\SysWOW64\HZPNR.exe.bat KUJQK.exe File created C:\windows\SysWOW64\RHFK.exe GOKSNRY.exe File created C:\windows\SysWOW64\TQVH.exe.bat IXS.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe ARHO.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe ZQDY.exe File created C:\windows\SysWOW64\YSAU.exe.bat HFQCSM.exe File created C:\windows\SysWOW64\IKFR.exe.bat GMMXIB.exe File created C:\windows\SysWOW64\ZVQXC.exe THRW.exe File created C:\windows\SysWOW64\ZVQXC.exe.bat THRW.exe File opened for modification C:\windows\SysWOW64\BLAB.exe AIWXJZY.exe File created C:\windows\SysWOW64\UPG.exe IWDD.exe File created C:\windows\SysWOW64\SRKHU.exe.bat FHUIG.exe File created C:\windows\SysWOW64\EXTVTQ.exe JKPMI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\KLW.exe NFRTXFV.exe File created C:\windows\KWMTBFF.exe.bat SSJ.exe File created C:\windows\OGP.exe.bat SAR.exe File created C:\windows\system\AME.exe.bat PTBQQRQ.exe File opened for modification C:\windows\system\FKHJ.exe QUGSTE.exe File opened for modification C:\windows\system\YCCCDSN.exe SHDCZP.exe File created C:\windows\ZTRY.exe.bat INH.exe File created C:\windows\AWWMWF.exe FJRD.exe File created C:\windows\system\IJWLZF.exe ZBUGWIH.exe File created C:\windows\FTK.exe.bat FOKORII.exe File created C:\windows\URZS.exe.bat ZWDJAGY.exe File created C:\windows\system\CDVF.exe WDNSCXT.exe File created C:\windows\system\EAEOC.exe DXA.exe File created C:\windows\system\SSJ.exe RPFUQAV.exe File created C:\windows\FHUIG.exe.bat IJWLZF.exe File opened for modification C:\windows\system\TIN.exe NIGTON.exe File opened for modification C:\windows\ZMUMNWT.exe TMNZE.exe File created C:\windows\FJYAQG.exe.bat TQVH.exe File created C:\windows\UPFAXEM.exe.bat UJFLWR.exe File created C:\windows\OGP.exe SAR.exe File opened for modification C:\windows\system\PQBMIK.exe JQUQ.exe File created C:\windows\UQVGEYM.exe ZVQXC.exe File created C:\windows\system\FOKORII.exe.bat ZNCAI.exe File opened for modification C:\windows\system\CXKIYQ.exe IKFR.exe File created C:\windows\system\CDVF.exe.bat WDNSCXT.exe File opened for modification C:\windows\JQUQ.exe OCPHPQT.exe File created C:\windows\system\TIN.exe.bat NIGTON.exe File created C:\windows\system\FKHJ.exe QUGSTE.exe File opened for modification C:\windows\TMNZE.exe TQIWLXI.exe File created C:\windows\IPD.exe TUTDUHS.exe File created C:\windows\ICJLD.exe RPZTNPA.exe File created C:\windows\TPDKQPP.exe.bat WKXNJGV.exe File opened for modification C:\windows\system\UKPWOE.exe JRMD.exe File created C:\windows\FJRD.exe KWMTBFF.exe File opened for modification C:\windows\system\IJWLZF.exe ZBUGWIH.exe File opened for modification C:\windows\UPFAXEM.exe UJFLWR.exe File opened for modification C:\windows\system\NIGTON.exe EAEOC.exe File created C:\windows\system\JKPMI.exe UPFAXEM.exe File created C:\windows\PTBQQRQ.exe UGXHG.exe File created C:\windows\system\DXA.exe OCRGM.exe File created C:\windows\OQQSJ.exe.bat IQI.exe File created C:\windows\system\LQNNOS.exe.bat CQL.exe File created C:\windows\THRW.exe.bat ZMUMNWT.exe File created C:\windows\FHUIG.exe IJWLZF.exe File opened for modification C:\windows\system\CDVF.exe WDNSCXT.exe File opened for modification C:\windows\system\DXA.exe OCRGM.exe File created C:\windows\MHVO.exe.bat OWSYH.exe File opened for modification C:\windows\KUYEC.exe PGUV.exe File created C:\windows\system\SSJ.exe.bat RPFUQAV.exe File created C:\windows\system\PXLFZEF.exe UKPWOE.exe File opened for modification C:\windows\VPLLZR.exe RHFK.exe File created C:\windows\PTBQQRQ.exe.bat UGXHG.exe File created C:\windows\system\SHDCZP.exe MHVO.exe File opened for modification C:\windows\SXGHL.exe JZZOQL.exe File created C:\windows\system\PXLFZEF.exe.bat UKPWOE.exe File created C:\windows\XNMNGGJ.exe.bat VPLLZR.exe File opened for modification C:\windows\WKXNJGV.exe XZV.exe File created C:\windows\KLW.exe.bat NFRTXFV.exe File created C:\windows\NZUCP.exe.bat XELYESU.exe File created C:\windows\system\UJFLWR.exe ZOAC.exe File created C:\windows\KUYEC.exe.bat PGUV.exe File created C:\windows\THRW.exe ZMUMNWT.exe File created C:\windows\system\UKPWOE.exe.bat JRMD.exe File opened for modification C:\windows\system\FOKORII.exe ZNCAI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6552 cmd.exe 5732 cmd.exe 2740 cmd.exe 2628 cmd.exe 1176 cmd.exe 7108 cmd.exe 592 cmd.exe 6580 cmd.exe 3332 cmd.exe 1552 cmd.exe 6428 cmd.exe 5112 cmd.exe 2556 cmd.exe 468 cmd.exe 4552 cmd.exe 1328 cmd.exe 2156 cmd.exe 4692 cmd.exe 5080 cmd.exe 2260 cmd.exe 2900 cmd.exe 4108 cmd.exe 1052 cmd.exe 2884 cmd.exe 5336 cmd.exe 2608 cmd.exe 6796 cmd.exe 956 cmd.exe 1544 cmd.exe 6736 cmd.exe 2748 cmd.exe 2288 cmd.exe 4644 cmd.exe 2916 cmd.exe 1732 cmd.exe 5360 cmd.exe 6360 cmd.exe 5176 cmd.exe 6844 cmd.exe 6500 cmd.exe 5612 cmd.exe 6632 cmd.exe 2272 cmd.exe 5964 cmd.exe 1196 cmd.exe 7120 cmd.exe 4592 cmd.exe 6848 cmd.exe 2068 cmd.exe 6924 cmd.exe 4544 cmd.exe 5888 cmd.exe 6296 cmd.exe 3344 cmd.exe 2080 cmd.exe 1312 cmd.exe 6904 cmd.exe 4492 cmd.exe 2012 cmd.exe 1232 cmd.exe 6772 cmd.exe 2772 cmd.exe 4912 cmd.exe 6196 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4944 3564 WerFault.exe 88 4964 1520 WerFault.exe 94 7148 6416 WerFault.exe 100 2348 3492 WerFault.exe 105 3680 6352 WerFault.exe 110 3424 3308 WerFault.exe 115 3980 6768 WerFault.exe 120 5420 3628 WerFault.exe 125 5056 4596 WerFault.exe 130 1896 5388 WerFault.exe 135 7104 5644 WerFault.exe 140 3376 6996 WerFault.exe 145 7008 2676 WerFault.exe 150 3156 6444 WerFault.exe 155 5228 4244 WerFault.exe 160 5964 6292 WerFault.exe 165 2576 4616 WerFault.exe 170 4524 3820 WerFault.exe 175 3020 5700 WerFault.exe 180 4960 2872 WerFault.exe 185 4760 6588 WerFault.exe 190 3340 3968 WerFault.exe 195 1196 5860 WerFault.exe 200 1432 1276 WerFault.exe 205 6856 964 WerFault.exe 210 2164 4800 WerFault.exe 215 6840 5492 WerFault.exe 220 1104 7064 WerFault.exe 225 5368 6472 WerFault.exe 230 2100 1600 WerFault.exe 235 6228 6040 WerFault.exe 240 940 2224 WerFault.exe 245 6480 4272 WerFault.exe 250 4240 6424 WerFault.exe 255 6244 4944 WerFault.exe 260 3428 6928 WerFault.exe 265 4828 5540 WerFault.exe 270 5256 4532 WerFault.exe 275 592 6616 WerFault.exe 280 4880 4220 WerFault.exe 286 6088 6720 WerFault.exe 291 5708 1784 WerFault.exe 296 1980 4336 WerFault.exe 301 1420 2376 WerFault.exe 306 1360 7088 WerFault.exe 311 2444 6392 WerFault.exe 316 6680 1272 WerFault.exe 321 6128 4320 WerFault.exe 326 1948 1904 WerFault.exe 331 4524 2936 WerFault.exe 336 2672 1712 WerFault.exe 341 1408 3020 WerFault.exe 346 4604 1268 WerFault.exe 351 5600 3016 WerFault.exe 356 4396 2984 WerFault.exe 361 236 3980 WerFault.exe 366 4836 5060 WerFault.exe 371 6064 4228 WerFault.exe 376 1420 6556 WerFault.exe 381 6992 5132 WerFault.exe 386 5188 1072 WerFault.exe 391 2324 4864 WerFault.exe 396 720 6776 WerFault.exe 401 1796 1288 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXLFZEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXTVTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFQCSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCRGM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQNNOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHUIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSPCCDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTRXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCCCDSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWWQQEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJFLWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWDJAGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBUGWIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZUCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPFUQAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYFDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGTIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWMTBFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCNCEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3564 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe 3564 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe 1520 JZZOQL.exe 1520 JZZOQL.exe 6416 SXGHL.exe 6416 SXGHL.exe 3492 INH.exe 3492 INH.exe 6352 ZTRY.exe 6352 ZTRY.exe 3308 YDC.exe 3308 YDC.exe 6768 MJAEX.exe 6768 MJAEX.exe 3628 DRCRAG.exe 3628 DRCRAG.exe 4596 PKFBJVK.exe 4596 PKFBJVK.exe 5388 JXKL.exe 5388 JXKL.exe 5644 NFRTXFV.exe 5644 NFRTXFV.exe 6996 KLW.exe 6996 KLW.exe 2676 COAMS.exe 2676 COAMS.exe 6444 IOIZBHA.exe 6444 IOIZBHA.exe 4244 JRMD.exe 4244 JRMD.exe 6292 UKPWOE.exe 6292 UKPWOE.exe 4616 PXLFZEF.exe 4616 PXLFZEF.exe 3820 LDRU.exe 3820 LDRU.exe 5700 TIEJ.exe 5700 TIEJ.exe 2872 RILXZP.exe 2872 RILXZP.exe 6588 XELYESU.exe 6588 XELYESU.exe 3968 NZUCP.exe 3968 NZUCP.exe 5860 TUTDUHS.exe 5860 TUTDUHS.exe 1276 IPD.exe 1276 IPD.exe 964 RPFUQAV.exe 964 RPFUQAV.exe 4800 SSJ.exe 4800 SSJ.exe 5492 KWMTBFF.exe 5492 KWMTBFF.exe 7064 FJRD.exe 7064 FJRD.exe 6472 AWWMWF.exe 6472 AWWMWF.exe 1600 RJGELCX.exe 1600 RJGELCX.exe 6040 RPZTNPA.exe 6040 RPZTNPA.exe 2224 ICJLD.exe 2224 ICJLD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3564 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe 3564 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe 1520 JZZOQL.exe 1520 JZZOQL.exe 6416 SXGHL.exe 6416 SXGHL.exe 3492 INH.exe 3492 INH.exe 6352 ZTRY.exe 6352 ZTRY.exe 3308 YDC.exe 3308 YDC.exe 6768 MJAEX.exe 6768 MJAEX.exe 3628 DRCRAG.exe 3628 DRCRAG.exe 4596 PKFBJVK.exe 4596 PKFBJVK.exe 5388 JXKL.exe 5388 JXKL.exe 5644 NFRTXFV.exe 5644 NFRTXFV.exe 6996 KLW.exe 6996 KLW.exe 2676 COAMS.exe 2676 COAMS.exe 6444 IOIZBHA.exe 6444 IOIZBHA.exe 4244 JRMD.exe 4244 JRMD.exe 6292 UKPWOE.exe 6292 UKPWOE.exe 4616 PXLFZEF.exe 4616 PXLFZEF.exe 3820 LDRU.exe 3820 LDRU.exe 5700 TIEJ.exe 5700 TIEJ.exe 2872 RILXZP.exe 2872 RILXZP.exe 6588 XELYESU.exe 6588 XELYESU.exe 3968 NZUCP.exe 3968 NZUCP.exe 5860 TUTDUHS.exe 5860 TUTDUHS.exe 1276 IPD.exe 1276 IPD.exe 964 RPFUQAV.exe 964 RPFUQAV.exe 4800 SSJ.exe 4800 SSJ.exe 5492 KWMTBFF.exe 5492 KWMTBFF.exe 7064 FJRD.exe 7064 FJRD.exe 6472 AWWMWF.exe 6472 AWWMWF.exe 1600 RJGELCX.exe 1600 RJGELCX.exe 6040 RPZTNPA.exe 6040 RPZTNPA.exe 2224 ICJLD.exe 2224 ICJLD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4580 3564 2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe 90 PID 4580 wrote to memory of 1520 4580 cmd.exe 94 PID 1520 wrote to memory of 6796 1520 JZZOQL.exe 96 PID 6796 wrote to memory of 6416 6796 cmd.exe 100 PID 6416 wrote to memory of 4492 6416 SXGHL.exe 101 PID 4492 wrote to memory of 3492 4492 cmd.exe 105 PID 3492 wrote to memory of 3452 3492 INH.exe 106 PID 3452 wrote to memory of 6352 3452 cmd.exe 110 PID 6352 wrote to memory of 5876 6352 ZTRY.exe 111 PID 5876 wrote to memory of 3308 5876 cmd.exe 115 PID 3308 wrote to memory of 6436 3308 YDC.exe 116 PID 6436 wrote to memory of 6768 6436 cmd.exe 120 PID 6768 wrote to memory of 468 6768 MJAEX.exe 121 PID 468 wrote to memory of 3628 468 cmd.exe 125 PID 3628 wrote to memory of 2272 3628 DRCRAG.exe 126 PID 2272 wrote to memory of 4596 2272 cmd.exe 130 PID 4596 wrote to memory of 6552 4596 PKFBJVK.exe 131 PID 6552 wrote to memory of 5388 6552 cmd.exe 135 PID 5388 wrote to memory of 4304 5388 JXKL.exe 136 PID 4304 wrote to memory of 5644 4304 cmd.exe 140 PID 5644 wrote to memory of 4340 5644 NFRTXFV.exe 141 PID 4340 wrote to memory of 6996 4340 cmd.exe 145 PID 6996 wrote to memory of 6308 6996 KLW.exe 146 PID 6308 wrote to memory of 2676 6308 cmd.exe 150 PID 2676 wrote to memory of 6924 2676 COAMS.exe 151 PID 6924 wrote to memory of 6444 6924 cmd.exe 155 PID 6444 wrote to memory of 6156 6444 IOIZBHA.exe 156 PID 6156 wrote to memory of 4244 6156 cmd.exe 160 PID 4244 wrote to memory of 2920 4244 JRMD.exe 161 PID 2920 wrote to memory of 6292 2920 cmd.exe 165 PID 6292 wrote to memory of 4300 6292 UKPWOE.exe 166 PID 4300 wrote to memory of 4616 4300 cmd.exe 170 PID 4616 wrote to memory of 4804 4616 PXLFZEF.exe 171 PID 4804 wrote to memory of 3820 4804 cmd.exe 175 PID 3820 wrote to memory of 3732 3820 LDRU.exe 176 PID 3732 wrote to memory of 5700 3732 cmd.exe 180 PID 5700 wrote to memory of 3332 5700 TIEJ.exe 181 PID 3332 wrote to memory of 2872 3332 cmd.exe 185 PID 2872 wrote to memory of 5732 2872 RILXZP.exe 186 PID 5732 wrote to memory of 6588 5732 cmd.exe 190 PID 6588 wrote to memory of 2848 6588 XELYESU.exe 191 PID 2848 wrote to memory of 3968 2848 cmd.exe 195 PID 3968 wrote to memory of 4544 3968 NZUCP.exe 196 PID 4544 wrote to memory of 5860 4544 cmd.exe 200 PID 5860 wrote to memory of 4912 5860 TUTDUHS.exe 201 PID 4912 wrote to memory of 1276 4912 cmd.exe 205 PID 1276 wrote to memory of 3592 1276 IPD.exe 206 PID 3592 wrote to memory of 964 3592 cmd.exe 210 PID 964 wrote to memory of 6484 964 RPFUQAV.exe 211 PID 6484 wrote to memory of 4800 6484 cmd.exe 215 PID 4800 wrote to memory of 6980 4800 SSJ.exe 216 PID 6980 wrote to memory of 5492 6980 cmd.exe 220 PID 5492 wrote to memory of 6496 5492 KWMTBFF.exe 221 PID 6496 wrote to memory of 7064 6496 cmd.exe 225 PID 7064 wrote to memory of 5108 7064 FJRD.exe 226 PID 5108 wrote to memory of 6472 5108 cmd.exe 230 PID 6472 wrote to memory of 5728 6472 AWWMWF.exe 231 PID 5728 wrote to memory of 1600 5728 cmd.exe 235 PID 1600 wrote to memory of 2512 1600 RJGELCX.exe 236 PID 2512 wrote to memory of 6040 2512 cmd.exe 240 PID 6040 wrote to memory of 6888 6040 RPZTNPA.exe 241 PID 6888 wrote to memory of 2224 6888 cmd.exe 245 PID 2224 wrote to memory of 4504 2224 ICJLD.exe 246 PID 4504 wrote to memory of 4272 4504 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_2092c3680678c802b4ecb7f537b85786_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZOQL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\JZZOQL.exeC:\windows\system\JZZOQL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXGHL.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6796 -
C:\windows\SXGHL.exeC:\windows\SXGHL.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INH.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\system\INH.exeC:\windows\system\INH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTRY.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\ZTRY.exeC:\windows\ZTRY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\SysWOW64\YDC.exeC:\windows\system32\YDC.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJAEX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6436 -
C:\windows\SysWOW64\MJAEX.exeC:\windows\system32\MJAEX.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRCRAG.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\SysWOW64\DRCRAG.exeC:\windows\system32\DRCRAG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKFBJVK.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\SysWOW64\PKFBJVK.exeC:\windows\system32\PKFBJVK.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXKL.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6552 -
C:\windows\JXKL.exeC:\windows\JXKL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFRTXFV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\SysWOW64\NFRTXFV.exeC:\windows\system32\NFRTXFV.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\KLW.exeC:\windows\KLW.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COAMS.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6308 -
C:\windows\system\COAMS.exeC:\windows\system\COAMS.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOIZBHA.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6924 -
C:\windows\system\IOIZBHA.exeC:\windows\system\IOIZBHA.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRMD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:6156 -
C:\windows\SysWOW64\JRMD.exeC:\windows\system32\JRMD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UKPWOE.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\system\UKPWOE.exeC:\windows\system\UKPWOE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXLFZEF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\PXLFZEF.exeC:\windows\system\PXLFZEF.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LDRU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\LDRU.exeC:\windows\LDRU.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RILXZP.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\system\RILXZP.exeC:\windows\system\RILXZP.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XELYESU.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\system\XELYESU.exeC:\windows\system\XELYESU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NZUCP.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\NZUCP.exeC:\windows\NZUCP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IPD.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\IPD.exeC:\windows\IPD.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RPFUQAV.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\windows\RPFUQAV.exeC:\windows\RPFUQAV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6484 -
C:\windows\system\SSJ.exeC:\windows\system\SSJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWMTBFF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6980 -
C:\windows\KWMTBFF.exeC:\windows\KWMTBFF.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJRD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6496 -
C:\windows\FJRD.exeC:\windows\FJRD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWWMWF.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\AWWMWF.exeC:\windows\AWWMWF.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICJLD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6888 -
C:\windows\ICJLD.exeC:\windows\ICJLD.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIR.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5964 -
C:\windows\SysWOW64\OIR.exeC:\windows\system32\OIR.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBUGWIH.exe.bat" "68⤵PID:6008
-
C:\windows\SysWOW64\ZBUGWIH.exeC:\windows\system32\ZBUGWIH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJWLZF.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\windows\system\IJWLZF.exeC:\windows\system\IJWLZF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2740 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3396 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe75⤵
- Executes dropped EXE
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFPQFSN.exe.bat" "76⤵PID:1824
-
C:\windows\system\NFPQFSN.exeC:\windows\system\NFPQFSN.exe77⤵
- Executes dropped EXE
PID:6616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "78⤵PID:2632
-
C:\windows\ENJ.exeC:\windows\ENJ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "80⤵PID:2756
-
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe81⤵
- Executes dropped EXE
PID:6720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5080 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOAC.exe.bat" "84⤵PID:6336
-
C:\windows\ZOAC.exeC:\windows\ZOAC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2628 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "88⤵PID:2784
-
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:7088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "90⤵PID:3880
-
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1732 -
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "94⤵PID:3692
-
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1176 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "98⤵PID:6480
-
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:6240 -
C:\windows\FTK.exeC:\windows\FTK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "102⤵PID:1100
-
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZPNR.exe.bat" "104⤵PID:2348
-
C:\windows\SysWOW64\HZPNR.exeC:\windows\system32\HZPNR.exe105⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSAU.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5888 -
C:\windows\SysWOW64\YSAU.exeC:\windows\system32\YSAU.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYSI.exe.bat" "110⤵
- Executes a command shell one-liner
PID:6632 -
C:\windows\SysWOW64\YYSI.exeC:\windows\system32\YYSI.exe111⤵
- Executes dropped EXE
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDYGRY.exe.bat" "112⤵PID:2736
-
C:\windows\VDYGRY.exeC:\windows\VDYGRY.exe113⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "114⤵PID:1068
-
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "116⤵PID:2788
-
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "118⤵PID:2760
-
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "120⤵PID:5220
-
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-