Analysis
- max time kernel
86s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 21:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe
- Size 208KB
- Sample260825-1mtskawvhx
- SHA256 752352ec56bc0d4eab4222f9979815d856975c5bce100ecc491ef97545d41f52
- MD5 d3d8345eaa015b9efa98f4280123e19d
- SHA1 03ef41c27b845473a0db8ec9e682ed275bbc8183
- SHA512 7fd725182409877aa81d3ef3f580ae4ab1913e3c13c6282565447e5d98ed5f0b7239d8f9ee92d3f05021d3b4b47d6e493279418d6293e385fecc72f7ce90a3b8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf34NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LO/QEjK
- TLSH T1AB247D2236D2C073E4B7123188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1532 XQKJDF.exe 2140 YOFKOI.exe 6032 OEGKV.exe 5884 SUMKHOL.exe 5384 DCTS.exe 2724 LSU.exe 4612 NGZSC.exe 2352 DJIFNPT.exe 1428 MJKK.exe 3492 XBNDZ.exe 4368 KMW.exe 2812 ACXTUA.exe 3924 NNNR.exe 368 IASBSC.exe 2400 ZBUGWIH.exe 2732 FBBUF.exe 1440 YEFP.exe 2568 BMMXWK.exe 968 EHR.exe 2856 LXSG.exe 6044 XFYG.exe 2896 BVFGEI.exe 1304 LWHTPOV.exe 1528 CEJ.exe 1592 RZSDEY.exe 4444 PMSD.exe 1980 OKD.exe 4988 SNBBDZ.exe 4888 EDQ.exe 1844 ILWCU.exe 4260 RUYPXHS.exe 2220 XUGC.exe 6016 DUOQXM.exe 4980 VPR.exe 3740 DDKA.exe 1384 TYBNXBA.exe 5524 TDTTZGC.exe 3644 IYDFK.exe 5060 KWQAZ.exe 1976 SCIGB.exe 564 QVTW.exe 2524 UDAEVVZ.exe 2744 PQFO.exe 4724 AJAGG.exe 4136 ZGT.exe 4600 IHVOE.exe 4456 TZQZFU.exe 1472 FSTSNBK.exe 5144 UNCEY.exe 2848 WIHOIOH.exe 2028 GIJ.exe 2932 YLNPZJL.exe 1808 ZORS.exe 4760 FPYGOB.exe 4772 JXN.exe 4984 JCFV.exe 3860 HAY.exe 4240 CNDH.exe 1512 FBAQJD.exe 5192 FOAFKQB.exe 5368 QHD.exe 3892 KUIHD.exe 2396 CZT.exe 3220 LIVE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\TDTTZGC.exe TYBNXBA.exe File created C:\windows\SysWOW64\UDAEVVZ.exe.bat QVTW.exe File opened for modification C:\windows\SysWOW64\JXN.exe FPYGOB.exe File created C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File opened for modification C:\windows\SysWOW64\OPHI.exe FPFDSCL.exe File created C:\windows\SysWOW64\QHW.exe.bat OJJSZC.exe File opened for modification C:\windows\SysWOW64\FBBUF.exe ZBUGWIH.exe File opened for modification C:\windows\SysWOW64\PMSD.exe RZSDEY.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat TYBNXBA.exe File created C:\windows\SysWOW64\KSHDAX.exe GKA.exe File created C:\windows\SysWOW64\KSHDAX.exe.bat GKA.exe File created C:\windows\SysWOW64\YOZ.exe.bat YLVS.exe File opened for modification C:\windows\SysWOW64\BUVBUQ.exe KUTWQ.exe File created C:\windows\SysWOW64\YNNVUUH.exe CQIGNK.exe File opened for modification C:\windows\SysWOW64\ZBUGWIH.exe IASBSC.exe File created C:\windows\SysWOW64\RUYPXHS.exe ILWCU.exe File created C:\windows\SysWOW64\FBAQJD.exe.bat CNDH.exe File created C:\windows\SysWOW64\SAWUXSR.exe.bat IAUPUU.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat TZQZFU.exe File opened for modification C:\windows\SysWOW64\FBAQJD.exe CNDH.exe File created C:\windows\SysWOW64\KUIHD.exe.bat QHD.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe WYA.exe File created C:\windows\SysWOW64\TRKWZUL.exe CMAE.exe File created C:\windows\SysWOW64\BUVBUQ.exe.bat KUTWQ.exe File opened for modification C:\windows\SysWOW64\TJSN.exe YNNVUUH.exe File opened for modification C:\windows\SysWOW64\BMMXWK.exe YEFP.exe File opened for modification C:\windows\SysWOW64\VPR.exe DUOQXM.exe File created C:\windows\SysWOW64\XAEI.exe.bat SAWUXSR.exe File opened for modification C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File created C:\windows\SysWOW64\YOFKOI.exe.bat XQKJDF.exe File opened for modification C:\windows\SysWOW64\KSHDAX.exe GKA.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat IYDFK.exe File created C:\windows\SysWOW64\LGXJRBE.exe OIRMK.exe File created C:\windows\SysWOW64\CYIQ.exe WYA.exe File created C:\windows\SysWOW64\SAWUXSR.exe IAUPUU.exe File created C:\windows\SysWOW64\ZBUGWIH.exe.bat IASBSC.exe File opened for modification C:\windows\SysWOW64\XQKJDF.exe 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe File created C:\windows\SysWOW64\UDAEVVZ.exe QVTW.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe TZQZFU.exe File created C:\windows\SysWOW64\TRKWZUL.exe.bat CMAE.exe File opened for modification C:\windows\SysWOW64\JEXE.exe JYWQ.exe File created C:\windows\SysWOW64\FSTSNBK.exe TZQZFU.exe File created C:\windows\SysWOW64\ZBUGWIH.exe IASBSC.exe File created C:\windows\SysWOW64\NGZSC.exe LSU.exe File created C:\windows\SysWOW64\JXN.exe.bat FPYGOB.exe File created C:\windows\SysWOW64\BMMXWK.exe.bat YEFP.exe File opened for modification C:\windows\SysWOW64\TZQZFU.exe IHVOE.exe File created C:\windows\SysWOW64\HUDX.exe.bat BUVBUQ.exe File opened for modification C:\windows\SysWOW64\DUOQXM.exe XUGC.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat XUGC.exe File opened for modification C:\windows\SysWOW64\BVFGEI.exe XFYG.exe File created C:\windows\SysWOW64\EDQ.exe SNBBDZ.exe File created C:\windows\SysWOW64\VPR.exe.bat DUOQXM.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat OIRMK.exe File created C:\windows\SysWOW64\CMAE.exe.bat CYIQ.exe File created C:\windows\SysWOW64\BVFGEI.exe XFYG.exe File created C:\windows\SysWOW64\DDKA.exe.bat VPR.exe File created C:\windows\SysWOW64\TDTTZGC.exe TYBNXBA.exe File created C:\windows\SysWOW64\TZQZFU.exe.bat IHVOE.exe File opened for modification C:\windows\SysWOW64\LGXJRBE.exe OIRMK.exe File created C:\windows\SysWOW64\EDQ.exe.bat SNBBDZ.exe File opened for modification C:\windows\SysWOW64\DDKA.exe VPR.exe File created C:\windows\SysWOW64\KWQAZ.exe IYDFK.exe File created C:\windows\SysWOW64\ZZITPSY.exe TZAGG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YLVS.exe.bat YFV.exe File created C:\windows\system\LSU.exe DCTS.exe File created C:\windows\CEJ.exe LWHTPOV.exe File created C:\windows\system\RZSDEY.exe.bat CEJ.exe File created C:\windows\FPFDSCL.exe JEXE.exe File created C:\windows\system\ACXTUA.exe.bat KMW.exe File created C:\windows\system\XUGC.exe RUYPXHS.exe File created C:\windows\TYBNXBA.exe.bat DDKA.exe File created C:\windows\YLNPZJL.exe.bat GIJ.exe File opened for modification C:\windows\system\TFK.exe TRKWZUL.exe File created C:\windows\system\IAUPUU.exe.bat TFK.exe File created C:\windows\YFV.exe.bat JCMRGA.exe File created C:\windows\system\SUMKHOL.exe OEGKV.exe File created C:\windows\system\LWHTPOV.exe.bat BVFGEI.exe File created C:\windows\ILWCU.exe.bat EDQ.exe File created C:\windows\IYDFK.exe TDTTZGC.exe File opened for modification C:\windows\UNCEY.exe FSTSNBK.exe File created C:\windows\system\LIVE.exe.bat CZT.exe File created C:\windows\CBXLNBD.exe RIUSFU.exe File created C:\windows\system\DCTS.exe SUMKHOL.exe File created C:\windows\XBNDZ.exe MJKK.exe File created C:\windows\JCFV.exe.bat JXN.exe File created C:\windows\system\QHD.exe FOAFKQB.exe File opened for modification C:\windows\system\IFOCSWO.exe ZXUXPR.exe File created C:\windows\system\FTKCPUN.exe.bat FOKNO.exe File created C:\windows\CQIGNK.exe.bat HUDX.exe File created C:\windows\system\IASBSC.exe.bat NNNR.exe File created C:\windows\YEFP.exe.bat FBBUF.exe File opened for modification C:\windows\system\ZGT.exe AJAGG.exe File created C:\windows\system\ZMD.exe.bat NTADWQT.exe File created C:\windows\UNMD.exe ZZITPSY.exe File opened for modification C:\windows\system\IAUPUU.exe TFK.exe File created C:\windows\system\OJJSZC.exe YOZ.exe File opened for modification C:\windows\system\LSU.exe DCTS.exe File opened for modification C:\windows\YEFP.exe FBBUF.exe File opened for modification C:\windows\CEJ.exe LWHTPOV.exe File created C:\windows\IHVOE.exe ZGT.exe File created C:\windows\CNDH.exe.bat HAY.exe File opened for modification C:\windows\system\LIVE.exe CZT.exe File created C:\windows\system\EJPO.exe JWKWURJ.exe File created C:\windows\system\FOKNO.exe.bat DQEBGZK.exe File created C:\windows\system\NNNR.exe ACXTUA.exe File created C:\windows\system\OKD.exe PMSD.exe File opened for modification C:\windows\system\XUGC.exe RUYPXHS.exe File opened for modification C:\windows\system\TZAGG.exe ZMD.exe File created C:\windows\system\JCMRGA.exe OPHI.exe File created C:\windows\XFYG.exe LXSG.exe File created C:\windows\AJAGG.exe.bat PQFO.exe File opened for modification C:\windows\IHVOE.exe ZGT.exe File opened for modification C:\windows\system\FPYGOB.exe ZORS.exe File created C:\windows\CZT.exe KUIHD.exe File opened for modification C:\windows\UNMD.exe ZZITPSY.exe File created C:\windows\system\FOKNO.exe DQEBGZK.exe File created C:\windows\system\JCMRGA.exe.bat OPHI.exe File created C:\windows\XBNDZ.exe.bat MJKK.exe File opened for modification C:\windows\system\KMW.exe XBNDZ.exe File created C:\windows\system\OKD.exe.bat PMSD.exe File created C:\windows\WIHOIOH.exe UNCEY.exe File opened for modification C:\windows\system\FTKCPUN.exe FOKNO.exe File created C:\windows\AIIC.exe KSHDAX.exe File opened for modification C:\windows\OEGKV.exe YOFKOI.exe File created C:\windows\system\ZMD.exe NTADWQT.exe File created C:\windows\system\JWKWURJ.exe.bat HJGNKR.exe File opened for modification C:\windows\MWWTMMY.exe LTS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1556 cmd.exe 3468 cmd.exe 4396 cmd.exe 2452 cmd.exe 1948 cmd.exe 4232 cmd.exe 2684 cmd.exe 4824 cmd.exe 3236 cmd.exe 5688 cmd.exe 1984 cmd.exe 1232 cmd.exe 3524 cmd.exe 2576 cmd.exe 5004 cmd.exe 2792 cmd.exe 4224 cmd.exe 4140 cmd.exe 1380 cmd.exe 4104 cmd.exe 4964 cmd.exe 3612 cmd.exe 6052 cmd.exe 2252 cmd.exe 1124 cmd.exe 704 cmd.exe 5068 cmd.exe 2944 cmd.exe 1324 cmd.exe 5416 cmd.exe 4452 cmd.exe 3608 cmd.exe 548 cmd.exe 3876 cmd.exe 6116 cmd.exe 3228 cmd.exe 1412 cmd.exe 2332 cmd.exe 904 cmd.exe 700 cmd.exe 2500 cmd.exe 5488 cmd.exe 2516 cmd.exe 4844 cmd.exe 4816 cmd.exe 4808 cmd.exe 2492 cmd.exe 3668 cmd.exe 2688 cmd.exe 6128 cmd.exe 4652 cmd.exe 3868 cmd.exe 2224 cmd.exe 5976 cmd.exe 1912 cmd.exe 2472 cmd.exe 3616 cmd.exe 2860 cmd.exe 1148 cmd.exe 5708 cmd.exe 2392 cmd.exe 2992 cmd.exe 820 cmd.exe 5796 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4232 3428 WerFault.exe 88 2776 1532 WerFault.exe 93 5416 2140 WerFault.exe 99 3644 6032 WerFault.exe 104 1776 5884 WerFault.exe 109 1312 5384 WerFault.exe 114 4936 2724 WerFault.exe 119 2932 4612 WerFault.exe 124 1572 2352 WerFault.exe 129 1716 1428 WerFault.exe 134 5340 3492 WerFault.exe 139 1088 4368 WerFault.exe 144 2652 2812 WerFault.exe 149 1296 3924 WerFault.exe 154 4624 368 WerFault.exe 159 2304 2400 WerFault.exe 164 3340 2732 WerFault.exe 169 3816 1440 WerFault.exe 174 2100 2568 WerFault.exe 179 1368 968 WerFault.exe 184 2744 2856 WerFault.exe 189 2396 6044 WerFault.exe 194 3684 2896 WerFault.exe 199 3180 1304 WerFault.exe 204 4868 1528 WerFault.exe 209 4468 1592 WerFault.exe 214 1944 4444 WerFault.exe 219 4240 1980 WerFault.exe 224 5144 4988 WerFault.exe 229 3936 4888 WerFault.exe 234 2028 1844 WerFault.exe 239 5164 4260 WerFault.exe 244 2544 2220 WerFault.exe 249 4916 6016 WerFault.exe 254 3668 4980 WerFault.exe 259 5128 3740 WerFault.exe 264 3424 1384 WerFault.exe 269 1944 5524 WerFault.exe 274 5900 3644 WerFault.exe 280 3516 5060 WerFault.exe 285 2944 1976 WerFault.exe 290 5088 564 WerFault.exe 295 3892 2524 WerFault.exe 300 4916 2744 WerFault.exe 305 5768 4724 WerFault.exe 310 788 4136 WerFault.exe 315 4728 4600 WerFault.exe 320 3176 4456 WerFault.exe 325 920 1472 WerFault.exe 330 3004 5144 WerFault.exe 335 3816 2848 WerFault.exe 340 4752 2028 WerFault.exe 345 908 2932 WerFault.exe 350 5628 1808 WerFault.exe 355 1256 4760 WerFault.exe 360 3464 4772 WerFault.exe 365 5520 4984 WerFault.exe 370 1172 3860 WerFault.exe 375 1776 4240 WerFault.exe 380 5956 1512 WerFault.exe 385 3524 5192 WerFault.exe 390 4712 5368 WerFault.exe 395 5672 3892 WerFault.exe 400 5080 2396 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBBUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUTWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNNVUUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQEBGZK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUOQXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILWCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWZBSZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVFGEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDAEVVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDTTZGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBXLNBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIHOIOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUMKHOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFOCSWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAQJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEGKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZORS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUVBUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXUXPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAWUXSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYDFK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3428 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe 3428 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe 1532 XQKJDF.exe 1532 XQKJDF.exe 2140 YOFKOI.exe 2140 YOFKOI.exe 6032 OEGKV.exe 6032 OEGKV.exe 5884 SUMKHOL.exe 5884 SUMKHOL.exe 5384 DCTS.exe 5384 DCTS.exe 2724 LSU.exe 2724 LSU.exe 4612 NGZSC.exe 4612 NGZSC.exe 2352 DJIFNPT.exe 2352 DJIFNPT.exe 1428 MJKK.exe 1428 MJKK.exe 3492 XBNDZ.exe 3492 XBNDZ.exe 4368 KMW.exe 4368 KMW.exe 2812 ACXTUA.exe 2812 ACXTUA.exe 3924 NNNR.exe 3924 NNNR.exe 368 IASBSC.exe 368 IASBSC.exe 2400 ZBUGWIH.exe 2400 ZBUGWIH.exe 2732 FBBUF.exe 2732 FBBUF.exe 1440 YEFP.exe 1440 YEFP.exe 2568 BMMXWK.exe 2568 BMMXWK.exe 968 EHR.exe 968 EHR.exe 2856 LXSG.exe 2856 LXSG.exe 6044 XFYG.exe 6044 XFYG.exe 2896 BVFGEI.exe 2896 BVFGEI.exe 1304 LWHTPOV.exe 1304 LWHTPOV.exe 1528 CEJ.exe 1528 CEJ.exe 1592 RZSDEY.exe 1592 RZSDEY.exe 4444 PMSD.exe 4444 PMSD.exe 1980 OKD.exe 1980 OKD.exe 4988 SNBBDZ.exe 4988 SNBBDZ.exe 4888 EDQ.exe 4888 EDQ.exe 1844 ILWCU.exe 1844 ILWCU.exe 4260 RUYPXHS.exe 4260 RUYPXHS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3428 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe 3428 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe 1532 XQKJDF.exe 1532 XQKJDF.exe 2140 YOFKOI.exe 2140 YOFKOI.exe 6032 OEGKV.exe 6032 OEGKV.exe 5884 SUMKHOL.exe 5884 SUMKHOL.exe 5384 DCTS.exe 5384 DCTS.exe 2724 LSU.exe 2724 LSU.exe 4612 NGZSC.exe 4612 NGZSC.exe 2352 DJIFNPT.exe 2352 DJIFNPT.exe 1428 MJKK.exe 1428 MJKK.exe 3492 XBNDZ.exe 3492 XBNDZ.exe 4368 KMW.exe 4368 KMW.exe 2812 ACXTUA.exe 2812 ACXTUA.exe 3924 NNNR.exe 3924 NNNR.exe 368 IASBSC.exe 368 IASBSC.exe 2400 ZBUGWIH.exe 2400 ZBUGWIH.exe 2732 FBBUF.exe 2732 FBBUF.exe 1440 YEFP.exe 1440 YEFP.exe 2568 BMMXWK.exe 2568 BMMXWK.exe 968 EHR.exe 968 EHR.exe 2856 LXSG.exe 2856 LXSG.exe 6044 XFYG.exe 6044 XFYG.exe 2896 BVFGEI.exe 2896 BVFGEI.exe 1304 LWHTPOV.exe 1304 LWHTPOV.exe 1528 CEJ.exe 1528 CEJ.exe 1592 RZSDEY.exe 1592 RZSDEY.exe 4444 PMSD.exe 4444 PMSD.exe 1980 OKD.exe 1980 OKD.exe 4988 SNBBDZ.exe 4988 SNBBDZ.exe 4888 EDQ.exe 4888 EDQ.exe 1844 ILWCU.exe 1844 ILWCU.exe 4260 RUYPXHS.exe 4260 RUYPXHS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3608 3428 2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe 89 PID 3608 wrote to memory of 1532 3608 cmd.exe 93 PID 1532 wrote to memory of 3000 1532 XQKJDF.exe 95 PID 3000 wrote to memory of 2140 3000 cmd.exe 99 PID 2140 wrote to memory of 2760 2140 YOFKOI.exe 100 PID 2760 wrote to memory of 6032 2760 cmd.exe 104 PID 6032 wrote to memory of 2660 6032 OEGKV.exe 105 PID 2660 wrote to memory of 5884 2660 cmd.exe 109 PID 5884 wrote to memory of 548 5884 SUMKHOL.exe 110 PID 548 wrote to memory of 5384 548 cmd.exe 114 PID 5384 wrote to memory of 608 5384 DCTS.exe 115 PID 608 wrote to memory of 2724 608 cmd.exe 119 PID 2724 wrote to memory of 1124 2724 LSU.exe 120 PID 1124 wrote to memory of 4612 1124 cmd.exe 124 PID 4612 wrote to memory of 2452 4612 NGZSC.exe 125 PID 2452 wrote to memory of 2352 2452 cmd.exe 129 PID 2352 wrote to memory of 4320 2352 DJIFNPT.exe 130 PID 4320 wrote to memory of 1428 4320 cmd.exe 134 PID 1428 wrote to memory of 5796 1428 MJKK.exe 135 PID 5796 wrote to memory of 3492 5796 cmd.exe 139 PID 3492 wrote to memory of 5744 3492 XBNDZ.exe 140 PID 5744 wrote to memory of 4368 5744 cmd.exe 144 PID 4368 wrote to memory of 1148 4368 KMW.exe 145 PID 1148 wrote to memory of 2812 1148 cmd.exe 149 PID 2812 wrote to memory of 2460 2812 ACXTUA.exe 150 PID 2460 wrote to memory of 3924 2460 cmd.exe 154 PID 3924 wrote to memory of 6132 3924 NNNR.exe 155 PID 6132 wrote to memory of 368 6132 cmd.exe 159 PID 368 wrote to memory of 1948 368 IASBSC.exe 160 PID 1948 wrote to memory of 2400 1948 cmd.exe 164 PID 2400 wrote to memory of 5988 2400 ZBUGWIH.exe 165 PID 5988 wrote to memory of 2732 5988 cmd.exe 169 PID 2732 wrote to memory of 3652 2732 FBBUF.exe 170 PID 3652 wrote to memory of 1440 3652 cmd.exe 174 PID 1440 wrote to memory of 2644 1440 YEFP.exe 175 PID 2644 wrote to memory of 2568 2644 cmd.exe 179 PID 2568 wrote to memory of 2736 2568 BMMXWK.exe 180 PID 2736 wrote to memory of 968 2736 cmd.exe 184 PID 968 wrote to memory of 4652 968 EHR.exe 185 PID 4652 wrote to memory of 2856 4652 cmd.exe 189 PID 2856 wrote to memory of 5944 2856 LXSG.exe 190 PID 5944 wrote to memory of 6044 5944 cmd.exe 194 PID 6044 wrote to memory of 6136 6044 XFYG.exe 195 PID 6136 wrote to memory of 2896 6136 cmd.exe 199 PID 2896 wrote to memory of 416 2896 BVFGEI.exe 200 PID 416 wrote to memory of 1304 416 cmd.exe 204 PID 1304 wrote to memory of 4232 1304 LWHTPOV.exe 205 PID 4232 wrote to memory of 1528 4232 cmd.exe 209 PID 1528 wrote to memory of 3020 1528 CEJ.exe 210 PID 3020 wrote to memory of 1592 3020 cmd.exe 214 PID 1592 wrote to memory of 4896 1592 RZSDEY.exe 215 PID 4896 wrote to memory of 4444 4896 cmd.exe 219 PID 4444 wrote to memory of 1264 4444 PMSD.exe 220 PID 1264 wrote to memory of 1980 1264 cmd.exe 224 PID 1980 wrote to memory of 6124 1980 OKD.exe 225 PID 6124 wrote to memory of 4988 6124 cmd.exe 229 PID 4988 wrote to memory of 3416 4988 SNBBDZ.exe 230 PID 3416 wrote to memory of 4888 3416 cmd.exe 234 PID 4888 wrote to memory of 3876 4888 EDQ.exe 235 PID 3876 wrote to memory of 1844 3876 cmd.exe 239 PID 1844 wrote to memory of 964 1844 ILWCU.exe 240 PID 964 wrote to memory of 4260 964 cmd.exe 244 PID 4260 wrote to memory of 1840 4260 RUYPXHS.exe 245 PID 1840 wrote to memory of 2220 1840 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_d3d8345eaa015b9efa98f4280123e19d_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOFKOI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\SysWOW64\YOFKOI.exeC:\windows\system32\YOFKOI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUMKHOL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\system\SUMKHOL.exeC:\windows\system\SUMKHOL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCTS.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\system\DCTS.exeC:\windows\system\DCTS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\windows\system\LSU.exeC:\windows\system\LSU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJIFNPT.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\system\DJIFNPT.exeC:\windows\system\DJIFNPT.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJKK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\MJKK.exeC:\windows\MJKK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBNDZ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\XBNDZ.exeC:\windows\XBNDZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\system\KMW.exeC:\windows\system\KMW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACXTUA.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\ACXTUA.exeC:\windows\system\ACXTUA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNNR.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\system\NNNR.exeC:\windows\system\NNNR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IASBSC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\system\IASBSC.exeC:\windows\system\IASBSC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBUGWIH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\SysWOW64\ZBUGWIH.exeC:\windows\system32\ZBUGWIH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBBUF.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\SysWOW64\FBBUF.exeC:\windows\system32\FBBUF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEFP.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\YEFP.exeC:\windows\YEFP.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\EHR.exeC:\windows\EHR.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXSG.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\LXSG.exeC:\windows\system\LXSG.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFYG.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\XFYG.exeC:\windows\XFYG.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVFGEI.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\SysWOW64\BVFGEI.exeC:\windows\system32\BVFGEI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\CEJ.exeC:\windows\CEJ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\SysWOW64\EDQ.exeC:\windows\system32\EDQ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUYPXHS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\windows\SysWOW64\RUYPXHS.exeC:\windows\system32\RUYPXHS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "66⤵PID:4448
-
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "68⤵
- Executes a command shell one-liner
PID:704 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5984 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "74⤵PID:4832
-
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "76⤵PID:1484
-
C:\windows\IYDFK.exeC:\windows\IYDFK.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "78⤵PID:5972
-
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe79⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2684 -
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe81⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4104 -
C:\windows\QVTW.exeC:\windows\QVTW.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "88⤵PID:4932
-
C:\windows\AJAGG.exeC:\windows\AJAGG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "90⤵PID:3448
-
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHVOE.exe.bat" "92⤵PID:3180
-
C:\windows\IHVOE.exeC:\windows\IHVOE.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "94⤵PID:5048
-
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "96⤵PID:3116
-
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "98⤵PID:5512
-
C:\windows\UNCEY.exeC:\windows\UNCEY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHOIOH.exe.bat" "100⤵PID:5804
-
C:\windows\WIHOIOH.exeC:\windows\WIHOIOH.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:700 -
C:\windows\GIJ.exeC:\windows\GIJ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLNPZJL.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2500 -
C:\windows\YLNPZJL.exeC:\windows\YLNPZJL.exe105⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZORS.exe.bat" "106⤵PID:5612
-
C:\windows\system\ZORS.exeC:\windows\system\ZORS.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "108⤵PID:4516
-
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXN.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2588 -
C:\windows\SysWOW64\JXN.exeC:\windows\system32\JXN.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JCFV.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6116 -
C:\windows\JCFV.exeC:\windows\JCFV.exe113⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "114⤵PID:1100
-
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNDH.exe.bat" "116⤵PID:1784
-
C:\windows\CNDH.exeC:\windows\CNDH.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBAQJD.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5488 -
C:\windows\SysWOW64\FBAQJD.exeC:\windows\system32\FBAQJD.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3228 -
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-