Analysis
- max time kernel
87s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe
- Size 208KB
- Sample260825-llpd5azdjf
- SHA256 7d4f8800c0adb854badfab8a1b30c3af2dc49663d6d2783dceb946df1c1af6fc
- MD5 7d3039ae8ef0ef4d210a64a2420d9fd3
- SHA1 5d774ab1a73c54fdceea566c72d5ae4048e32956
- SHA512 ba6004c3629a5f1823ead2dbee1a8d33eed589dd69029e3976797ea3071f450fdedf05f0ea4075b2f10879b51be07d554b3c229389e4d8e0ac0e7d2b0d01bcb7
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf/4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOnQEj1
- TLSH T105247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5200 SSZR.exe 5624 MGSPFY.exe 2576 WEYBMG.exe 3104 SBEYTQ.exe 5100 EUZRCXB.exe 5440 NHJJR.exe 2112 YAMC.exe 1356 PIOHDHG.exe 5816 TQVH.exe 6120 ODAYSZ.exe 2776 XMC.exe 2632 DMJRM.exe 976 PUQRYRI.exe 820 PIQ.exe 3968 YNAYQT.exe 4612 QVUDTYB.exe 4292 KIZM.exe 5428 QJHAMS.exe 2084 OEGJRVH.exe 3524 FJQBZ.exe 5976 AFVKJS.exe 4288 AKVZLEM.exe 3020 IVWSZJB.exe 5116 MLLAL.exe 2608 MQDOM.exe 5800 OEIYXOG.exe 3300 SUOYJGC.exe 4328 WCVG.exe 4696 HUYZV.exe 2720 RDAEZD.exe 1092 TQF.exe 4496 ODKXT.exe 5860 DYT.exe 300 DMTP.exe 4944 HUAXSV.exe 1500 CHF.exe 668 TPHM.exe 5764 IKQQZNC.exe 4596 TDT.exe 2648 RDTXQ.exe 4828 URYGSOI.exe 4020 DZAT.exe 1748 HHGTIM.exe 4116 SAJMQTN.exe 3040 YARA.exe 2408 XTU.exe 2580 GTWVT.exe 5504 HWZR.exe 872 WRRD.exe 3928 WXJRLPA.exe 5780 RKOB.exe 712 LFTKGO.exe 4448 RGAYPQ.exe 4500 BDGSEZ.exe 5632 KEIXIWP.exe 1164 OUPX.exe 4388 AMSQU.exe 5048 MUY.exe 6104 PCFYTHD.exe 5948 PQF.exe 3688 FLORFG.exe 3724 JRDI.exe 4888 ZMUMNWT.exe 3720 THRW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\LHD.exe WMTFL.exe File opened for modification C:\windows\SysWOW64\TMRXLF.exe WOMA.exe File opened for modification C:\windows\SysWOW64\OEGJRVH.exe QJHAMS.exe File created C:\windows\SysWOW64\AKVZLEM.exe AFVKJS.exe File created C:\windows\SysWOW64\LPFJKT.exe DZER.exe File opened for modification C:\windows\SysWOW64\IFVZXX.exe PCRDRAC.exe File created C:\windows\SysWOW64\WMTFL.exe NDRA.exe File created C:\windows\SysWOW64\LHD.exe WMTFL.exe File opened for modification C:\windows\SysWOW64\TZKLNS.exe TMRXLF.exe File opened for modification C:\windows\SysWOW64\EHNMOO.exe YLO.exe File created C:\windows\SysWOW64\IFVZXX.exe PCRDRAC.exe File created C:\windows\SysWOW64\OEGJRVH.exe.bat QJHAMS.exe File opened for modification C:\windows\SysWOW64\AKVZLEM.exe AFVKJS.exe File created C:\windows\SysWOW64\MQDOM.exe.bat MLLAL.exe File opened for modification C:\windows\SysWOW64\MIOECKQ.exe XFES.exe File opened for modification C:\windows\SysWOW64\HLCVLJ.exe ADB.exe File created C:\windows\SysWOW64\HLCVLJ.exe.bat ADB.exe File created C:\windows\SysWOW64\TMRXLF.exe WOMA.exe File created C:\windows\SysWOW64\RKOB.exe.bat WXJRLPA.exe File created C:\windows\SysWOW64\WIGDWM.exe CVKT.exe File created C:\windows\SysWOW64\LPFJKT.exe.bat DZER.exe File created C:\windows\SysWOW64\TZKLNS.exe.bat TMRXLF.exe File created C:\windows\SysWOW64\AKVZLEM.exe.bat AFVKJS.exe File created C:\windows\SysWOW64\JRDI.exe FLORFG.exe File created C:\windows\SysWOW64\JRDI.exe.bat FLORFG.exe File created C:\windows\SysWOW64\IFVZXX.exe.bat PCRDRAC.exe File opened for modification C:\windows\SysWOW64\ADB.exe ONUWA.exe File created C:\windows\SysWOW64\ADB.exe.bat ONUWA.exe File created C:\windows\SysWOW64\JRJFGK.exe FJDX.exe File created C:\windows\SysWOW64\AFVKJS.exe FJQBZ.exe File created C:\windows\SysWOW64\HUAXSV.exe DMTP.exe File created C:\windows\SysWOW64\FLORFG.exe PQF.exe File created C:\windows\SysWOW64\EHNMOO.exe.bat YLO.exe File created C:\windows\SysWOW64\HLCVLJ.exe ADB.exe File created C:\windows\SysWOW64\JRJFGK.exe.bat FJDX.exe File created C:\windows\SysWOW64\YARA.exe SAJMQTN.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe DMTP.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat DMTP.exe File opened for modification C:\windows\SysWOW64\MUY.exe AMSQU.exe File opened for modification C:\windows\SysWOW64\WIGDWM.exe CVKT.exe File created C:\windows\SysWOW64\PCRDRAC.exe.bat YBPQG.exe File opened for modification C:\windows\SysWOW64\KFUDDPT.exe TZKLNS.exe File opened for modification C:\windows\SysWOW64\JRJFGK.exe FJDX.exe File created C:\windows\SysWOW64\QVUDTYB.exe.bat YNAYQT.exe File created C:\windows\SysWOW64\OEGJRVH.exe QJHAMS.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe MLLAL.exe File created C:\windows\SysWOW64\RKOB.exe WXJRLPA.exe File opened for modification C:\windows\SysWOW64\LPFJKT.exe DZER.exe File opened for modification C:\windows\SysWOW64\PCRDRAC.exe YBPQG.exe File created C:\windows\SysWOW64\KFUDDPT.exe.bat TZKLNS.exe File created C:\windows\SysWOW64\ZPFNXN.exe NHQ.exe File opened for modification C:\windows\SysWOW64\KIZM.exe QVUDTYB.exe File opened for modification C:\windows\SysWOW64\RKOB.exe WXJRLPA.exe File opened for modification C:\windows\SysWOW64\FLORFG.exe PQF.exe File created C:\windows\SysWOW64\ODA.exe.bat UQVGEYM.exe File opened for modification C:\windows\SysWOW64\VQXZ.exe UNTDZ.exe File opened for modification C:\windows\SysWOW64\WMTFL.exe NDRA.exe File opened for modification C:\windows\SysWOW64\AFVKJS.exe FJQBZ.exe File created C:\windows\SysWOW64\MQDOM.exe MLLAL.exe File created C:\windows\SysWOW64\MIOECKQ.exe XFES.exe File created C:\windows\SysWOW64\LHD.exe.bat WMTFL.exe File opened for modification C:\windows\SysWOW64\YARA.exe SAJMQTN.exe File created C:\windows\SysWOW64\YARA.exe.bat SAJMQTN.exe File created C:\windows\SysWOW64\MUY.exe.bat AMSQU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BDGSEZ.exe.bat RGAYPQ.exe File created C:\windows\XFES.exe ZSFRMU.exe File created C:\windows\system\NHJJR.exe EUZRCXB.exe File created C:\windows\system\DMJRM.exe XMC.exe File opened for modification C:\windows\DMTP.exe DYT.exe File opened for modification C:\windows\SBEYTQ.exe WEYBMG.exe File created C:\windows\SBEYTQ.exe WEYBMG.exe File created C:\windows\system\DMJRM.exe.bat XMC.exe File created C:\windows\RGAYPQ.exe LFTKGO.exe File created C:\windows\ZMUMNWT.exe.bat JRDI.exe File created C:\windows\THRW.exe.bat ZMUMNWT.exe File opened for modification C:\windows\VXX.exe KFUDDPT.exe File opened for modification C:\windows\system\WCVG.exe SUOYJGC.exe File created C:\windows\DZAT.exe.bat URYGSOI.exe File created C:\windows\system\GTWVT.exe XTU.exe File created C:\windows\MGSPFY.exe.bat SSZR.exe File opened for modification C:\windows\system\PCFYTHD.exe MUY.exe File created C:\windows\system\PQF.exe PCFYTHD.exe File created C:\windows\system\GUIBO.exe.bat LHD.exe File created C:\windows\QTCFN.exe.bat VXX.exe File opened for modification C:\windows\YNAYQT.exe PIQ.exe File created C:\windows\system\RDAEZD.exe HUYZV.exe File created C:\windows\TQF.exe RDAEZD.exe File created C:\windows\IKQQZNC.exe TPHM.exe File created C:\windows\system\HWZR.exe.bat GTWVT.exe File created C:\windows\BDGSEZ.exe RGAYPQ.exe File created C:\windows\UCXY.exe.bat EHNMOO.exe File opened for modification C:\windows\HIFKJMY.exe UCXY.exe File created C:\windows\system\ODAYSZ.exe TQVH.exe File created C:\windows\system\QJHAMS.exe KIZM.exe File created C:\windows\system\IVWSZJB.exe AKVZLEM.exe File created C:\windows\TPHM.exe.bat CHF.exe File created C:\windows\system\HHGTIM.exe.bat DZAT.exe File created C:\windows\system\AMSQU.exe OUPX.exe File created C:\windows\system\PCFYTHD.exe MUY.exe File created C:\windows\system\CVKT.exe HIFKJMY.exe File created C:\windows\EUZRCXB.exe SBEYTQ.exe File created C:\windows\XZXWUET.exe DMAMS.exe File created C:\windows\system\GUIBO.exe LHD.exe File opened for modification C:\windows\NDRA.exe MIOECKQ.exe File created C:\windows\TORYKI.exe.bat YBMG.exe File created C:\windows\SUOYJGC.exe.bat OEIYXOG.exe File created C:\windows\URYGSOI.exe RDTXQ.exe File created C:\windows\KLGLQ.exe.bat VQXZ.exe File created C:\windows\system\NHQ.exe.bat JRJFGK.exe File created C:\windows\IXZS.exe.bat ZPFNXN.exe File opened for modification C:\windows\TQF.exe RDAEZD.exe File opened for modification C:\windows\ODKXT.exe TQF.exe File opened for modification C:\windows\UQVGEYM.exe LITBA.exe File created C:\windows\system\PIQ.exe.bat PUQRYRI.exe File created C:\windows\system\RDTXQ.exe TDT.exe File created C:\windows\system\RDTXQ.exe.bat TDT.exe File created C:\windows\WXJRLPA.exe WRRD.exe File created C:\windows\system\KRG.exe KLGLQ.exe File created C:\windows\system\ZSFRMU.exe.bat IFVZXX.exe File created C:\windows\IXZS.exe ZPFNXN.exe File created C:\windows\system\OUPX.exe.bat KEIXIWP.exe File opened for modification C:\windows\system\NHQ.exe JRJFGK.exe File opened for modification C:\windows\DMAMS.exe VGAY.exe File created C:\windows\YBPQG.exe KRG.exe File created C:\windows\FJDX.exe.bat QTCFN.exe File opened for modification C:\windows\system\YBMG.exe ULFGWPD.exe File created C:\windows\UQVGEYM.exe.bat LITBA.exe File created C:\windows\system\KRG.exe.bat KLGLQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1232 cmd.exe 3740 cmd.exe 3856 cmd.exe 5316 cmd.exe 3108 cmd.exe 816 cmd.exe 2412 cmd.exe 5196 cmd.exe 4716 cmd.exe 4492 cmd.exe 3408 cmd.exe 4684 cmd.exe 1596 cmd.exe 1376 cmd.exe 2680 cmd.exe 2612 cmd.exe 1184 cmd.exe 1760 cmd.exe 3312 cmd.exe 1324 cmd.exe 748 cmd.exe 2560 cmd.exe 5916 cmd.exe 4848 cmd.exe 4052 cmd.exe 5348 cmd.exe 4316 cmd.exe 3480 cmd.exe 2768 cmd.exe 2228 cmd.exe 5572 cmd.exe 2036 cmd.exe 3152 cmd.exe 4196 cmd.exe 5220 cmd.exe 1200 cmd.exe 924 cmd.exe 5028 cmd.exe 6096 cmd.exe 1080 cmd.exe 848 cmd.exe 3908 cmd.exe 5528 cmd.exe 5404 cmd.exe 3916 cmd.exe 2384 cmd.exe 1856 cmd.exe 2952 cmd.exe 1260 cmd.exe 4068 cmd.exe 3004 cmd.exe 1208 cmd.exe 2968 cmd.exe 2948 cmd.exe 2372 cmd.exe 2676 cmd.exe 4004 cmd.exe 5240 cmd.exe 3516 cmd.exe 4692 cmd.exe 4336 cmd.exe 5016 cmd.exe 1476 cmd.exe 5676 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1332 3980 WerFault.exe 86 5632 5200 WerFault.exe 92 2512 5624 WerFault.exe 98 4576 2576 WerFault.exe 103 5924 3104 WerFault.exe 108 5824 5100 WerFault.exe 113 6116 5440 WerFault.exe 118 1360 2112 WerFault.exe 123 4796 1356 WerFault.exe 128 5052 5816 WerFault.exe 133 5496 6120 WerFault.exe 138 2412 2776 WerFault.exe 143 3736 2632 WerFault.exe 148 4816 976 WerFault.exe 153 1500 820 WerFault.exe 158 6056 3968 WerFault.exe 163 3972 4612 WerFault.exe 168 4596 4292 WerFault.exe 173 3372 5428 WerFault.exe 178 4128 2084 WerFault.exe 183 2864 3524 WerFault.exe 188 2376 5976 WerFault.exe 193 6064 4288 WerFault.exe 198 2668 3020 WerFault.exe 203 4388 5116 WerFault.exe 208 4484 2608 WerFault.exe 213 4180 5800 WerFault.exe 218 5452 3300 WerFault.exe 223 2852 4328 WerFault.exe 228 5848 4696 WerFault.exe 233 4828 2720 WerFault.exe 238 4020 1092 WerFault.exe 243 4300 4496 WerFault.exe 248 4600 5860 WerFault.exe 253 4996 300 WerFault.exe 258 1560 4944 WerFault.exe 263 4380 1500 WerFault.exe 268 3304 668 WerFault.exe 273 920 5764 WerFault.exe 278 4924 4596 WerFault.exe 283 4100 2648 WerFault.exe 289 3992 4828 WerFault.exe 294 4304 4020 WerFault.exe 299 4692 1748 WerFault.exe 304 5592 4116 WerFault.exe 309 2624 3040 WerFault.exe 314 4380 2408 WerFault.exe 319 3916 2580 WerFault.exe 324 936 5504 WerFault.exe 329 848 872 WerFault.exe 334 748 3928 WerFault.exe 339 2712 5780 WerFault.exe 344 2788 712 WerFault.exe 349 1328 4448 WerFault.exe 354 4200 4500 WerFault.exe 359 4808 5632 WerFault.exe 364 4520 1164 WerFault.exe 369 2500 4388 WerFault.exe 374 936 5048 WerFault.exe 379 2384 6104 WerFault.exe 384 3976 5948 WerFault.exe 389 2096 3688 WerFault.exe 394 3856 3724 WerFault.exe 399 2956 4888 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBEYTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUYZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIFKJMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIOECKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLGLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJQBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSFRMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMAMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGSPFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVUDTYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUAXSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMSQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMJRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIOHDHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTWVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFVZXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCRDRAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAYPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHGTIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe 3980 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe 5200 SSZR.exe 5200 SSZR.exe 5624 MGSPFY.exe 5624 MGSPFY.exe 2576 WEYBMG.exe 2576 WEYBMG.exe 3104 SBEYTQ.exe 3104 SBEYTQ.exe 5100 EUZRCXB.exe 5100 EUZRCXB.exe 5440 NHJJR.exe 5440 NHJJR.exe 2112 YAMC.exe 2112 YAMC.exe 1356 PIOHDHG.exe 1356 PIOHDHG.exe 5816 TQVH.exe 5816 TQVH.exe 6120 ODAYSZ.exe 6120 ODAYSZ.exe 2776 XMC.exe 2776 XMC.exe 2632 DMJRM.exe 2632 DMJRM.exe 976 PUQRYRI.exe 976 PUQRYRI.exe 820 PIQ.exe 820 PIQ.exe 3968 YNAYQT.exe 3968 YNAYQT.exe 4612 QVUDTYB.exe 4612 QVUDTYB.exe 4292 KIZM.exe 4292 KIZM.exe 5428 QJHAMS.exe 5428 QJHAMS.exe 2084 OEGJRVH.exe 2084 OEGJRVH.exe 3524 FJQBZ.exe 3524 FJQBZ.exe 5976 AFVKJS.exe 5976 AFVKJS.exe 4288 AKVZLEM.exe 4288 AKVZLEM.exe 3020 IVWSZJB.exe 3020 IVWSZJB.exe 5116 MLLAL.exe 5116 MLLAL.exe 2608 MQDOM.exe 2608 MQDOM.exe 5800 OEIYXOG.exe 5800 OEIYXOG.exe 3300 SUOYJGC.exe 3300 SUOYJGC.exe 4328 WCVG.exe 4328 WCVG.exe 4696 HUYZV.exe 4696 HUYZV.exe 2720 RDAEZD.exe 2720 RDAEZD.exe 1092 TQF.exe 1092 TQF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3980 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe 3980 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe 5200 SSZR.exe 5200 SSZR.exe 5624 MGSPFY.exe 5624 MGSPFY.exe 2576 WEYBMG.exe 2576 WEYBMG.exe 3104 SBEYTQ.exe 3104 SBEYTQ.exe 5100 EUZRCXB.exe 5100 EUZRCXB.exe 5440 NHJJR.exe 5440 NHJJR.exe 2112 YAMC.exe 2112 YAMC.exe 1356 PIOHDHG.exe 1356 PIOHDHG.exe 5816 TQVH.exe 5816 TQVH.exe 6120 ODAYSZ.exe 6120 ODAYSZ.exe 2776 XMC.exe 2776 XMC.exe 2632 DMJRM.exe 2632 DMJRM.exe 976 PUQRYRI.exe 976 PUQRYRI.exe 820 PIQ.exe 820 PIQ.exe 3968 YNAYQT.exe 3968 YNAYQT.exe 4612 QVUDTYB.exe 4612 QVUDTYB.exe 4292 KIZM.exe 4292 KIZM.exe 5428 QJHAMS.exe 5428 QJHAMS.exe 2084 OEGJRVH.exe 2084 OEGJRVH.exe 3524 FJQBZ.exe 3524 FJQBZ.exe 5976 AFVKJS.exe 5976 AFVKJS.exe 4288 AKVZLEM.exe 4288 AKVZLEM.exe 3020 IVWSZJB.exe 3020 IVWSZJB.exe 5116 MLLAL.exe 5116 MLLAL.exe 2608 MQDOM.exe 2608 MQDOM.exe 5800 OEIYXOG.exe 5800 OEIYXOG.exe 3300 SUOYJGC.exe 3300 SUOYJGC.exe 4328 WCVG.exe 4328 WCVG.exe 4696 HUYZV.exe 4696 HUYZV.exe 2720 RDAEZD.exe 2720 RDAEZD.exe 1092 TQF.exe 1092 TQF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 4564 3980 2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe 88 PID 4564 wrote to memory of 5200 4564 cmd.exe 92 PID 5200 wrote to memory of 4156 5200 SSZR.exe 94 PID 4156 wrote to memory of 5624 4156 cmd.exe 98 PID 5624 wrote to memory of 4524 5624 MGSPFY.exe 99 PID 4524 wrote to memory of 2576 4524 cmd.exe 103 PID 2576 wrote to memory of 5704 2576 WEYBMG.exe 104 PID 5704 wrote to memory of 3104 5704 cmd.exe 108 PID 3104 wrote to memory of 4952 3104 SBEYTQ.exe 109 PID 4952 wrote to memory of 5100 4952 cmd.exe 113 PID 5100 wrote to memory of 2784 5100 EUZRCXB.exe 114 PID 2784 wrote to memory of 5440 2784 cmd.exe 118 PID 5440 wrote to memory of 2036 5440 NHJJR.exe 119 PID 2036 wrote to memory of 2112 2036 cmd.exe 123 PID 2112 wrote to memory of 200 2112 YAMC.exe 124 PID 200 wrote to memory of 1356 200 cmd.exe 128 PID 1356 wrote to memory of 1960 1356 PIOHDHG.exe 129 PID 1960 wrote to memory of 5816 1960 cmd.exe 133 PID 5816 wrote to memory of 1376 5816 TQVH.exe 134 PID 1376 wrote to memory of 6120 1376 cmd.exe 138 PID 6120 wrote to memory of 4604 6120 ODAYSZ.exe 139 PID 4604 wrote to memory of 2776 4604 cmd.exe 143 PID 2776 wrote to memory of 1772 2776 XMC.exe 144 PID 1772 wrote to memory of 2632 1772 cmd.exe 148 PID 2632 wrote to memory of 1480 2632 DMJRM.exe 149 PID 1480 wrote to memory of 976 1480 cmd.exe 153 PID 976 wrote to memory of 2560 976 PUQRYRI.exe 154 PID 2560 wrote to memory of 820 2560 cmd.exe 158 PID 820 wrote to memory of 1936 820 PIQ.exe 159 PID 1936 wrote to memory of 3968 1936 cmd.exe 163 PID 3968 wrote to memory of 3472 3968 YNAYQT.exe 164 PID 3472 wrote to memory of 4612 3472 cmd.exe 168 PID 4612 wrote to memory of 4628 4612 QVUDTYB.exe 169 PID 4628 wrote to memory of 4292 4628 cmd.exe 173 PID 4292 wrote to memory of 4864 4292 KIZM.exe 174 PID 4864 wrote to memory of 5428 4864 cmd.exe 178 PID 5428 wrote to memory of 2072 5428 QJHAMS.exe 179 PID 2072 wrote to memory of 2084 2072 cmd.exe 183 PID 2084 wrote to memory of 1888 2084 OEGJRVH.exe 184 PID 1888 wrote to memory of 3524 1888 cmd.exe 188 PID 3524 wrote to memory of 924 3524 FJQBZ.exe 189 PID 924 wrote to memory of 5976 924 cmd.exe 193 PID 5976 wrote to memory of 5496 5976 AFVKJS.exe 194 PID 5496 wrote to memory of 4288 5496 cmd.exe 198 PID 4288 wrote to memory of 2412 4288 AKVZLEM.exe 199 PID 2412 wrote to memory of 3020 2412 cmd.exe 203 PID 3020 wrote to memory of 1472 3020 IVWSZJB.exe 204 PID 1472 wrote to memory of 5116 1472 cmd.exe 208 PID 5116 wrote to memory of 4816 5116 MLLAL.exe 209 PID 4816 wrote to memory of 2608 4816 cmd.exe 213 PID 2608 wrote to memory of 3840 2608 MQDOM.exe 214 PID 3840 wrote to memory of 5800 3840 cmd.exe 218 PID 5800 wrote to memory of 5572 5800 OEIYXOG.exe 219 PID 5572 wrote to memory of 3300 5572 cmd.exe 223 PID 3300 wrote to memory of 2680 3300 SUOYJGC.exe 224 PID 2680 wrote to memory of 4328 2680 cmd.exe 228 PID 4328 wrote to memory of 1664 4328 WCVG.exe 229 PID 1664 wrote to memory of 4696 1664 cmd.exe 233 PID 4696 wrote to memory of 1576 4696 HUYZV.exe 234 PID 1576 wrote to memory of 2720 1576 cmd.exe 238 PID 2720 wrote to memory of 2452 2720 RDAEZD.exe 239 PID 2452 wrote to memory of 1092 2452 cmd.exe 243 PID 1092 wrote to memory of 5028 1092 TQF.exe 244 PID 5028 wrote to memory of 4496 5028 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7d3039ae8ef0ef4d210a64a2420d9fd3_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\SSZR.exeC:\windows\SSZR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGSPFY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\MGSPFY.exeC:\windows\MGSPFY.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHJJR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\system\NHJJR.exeC:\windows\system\NHJJR.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIOHDHG.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\PIOHDHG.exeC:\windows\PIOHDHG.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODAYSZ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\system\ODAYSZ.exeC:\windows\system\ODAYSZ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\XMC.exeC:\windows\XMC.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMJRM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\system\DMJRM.exeC:\windows\system\DMJRM.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJHAMS.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\system\QJHAMS.exeC:\windows\system\QJHAMS.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEGJRVH.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\SysWOW64\OEGJRVH.exeC:\windows\system32\OEGJRVH.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFVKJS.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\SysWOW64\AFVKJS.exeC:\windows\system32\AFVKJS.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AKVZLEM.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\windows\SysWOW64\AKVZLEM.exeC:\windows\system32\AKVZLEM.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVWSZJB.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\system\IVWSZJB.exeC:\windows\system\IVWSZJB.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLLAL.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\system\MLLAL.exeC:\windows\system\MLLAL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEIYXOG.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\windows\system\OEIYXOG.exeC:\windows\system\OEIYXOG.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUOYJGC.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\SUOYJGC.exeC:\windows\SUOYJGC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDAEZD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\system\RDAEZD.exeC:\windows\system\RDAEZD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQF.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\TQF.exeC:\windows\TQF.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODKXT.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\ODKXT.exeC:\windows\ODKXT.exe65⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYT.exe.bat" "66⤵PID:4056
-
C:\windows\SysWOW64\DYT.exeC:\windows\system32\DYT.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMTP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2612 -
C:\windows\DMTP.exeC:\windows\DMTP.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUAXSV.exe.bat" "70⤵PID:3308
-
C:\windows\SysWOW64\HUAXSV.exeC:\windows\system32\HUAXSV.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHF.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3908 -
C:\windows\system\CHF.exeC:\windows\system\CHF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPHM.exe.bat" "74⤵PID:1364
-
C:\windows\TPHM.exeC:\windows\TPHM.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKQQZNC.exe.bat" "76⤵PID:804
-
C:\windows\IKQQZNC.exeC:\windows\IKQQZNC.exe77⤵
- Executes dropped EXE
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TDT.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\windows\TDT.exeC:\windows\TDT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDTXQ.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5916 -
C:\windows\system\RDTXQ.exeC:\windows\system\RDTXQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URYGSOI.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5420 -
C:\windows\URYGSOI.exeC:\windows\URYGSOI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZAT.exe.bat" "84⤵PID:5628
-
C:\windows\DZAT.exeC:\windows\DZAT.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHGTIM.exe.bat" "86⤵PID:2376
-
C:\windows\system\HHGTIM.exeC:\windows\system\HHGTIM.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAJMQTN.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1184 -
C:\windows\SAJMQTN.exeC:\windows\SAJMQTN.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YARA.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\SysWOW64\YARA.exeC:\windows\system32\YARA.exe91⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTU.exe.bat" "92⤵PID:5164
-
C:\windows\XTU.exeC:\windows\XTU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GTWVT.exe.bat" "94⤵PID:6092
-
C:\windows\system\GTWVT.exeC:\windows\system\GTWVT.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWZR.exe.bat" "96⤵PID:2332
-
C:\windows\system\HWZR.exeC:\windows\system\HWZR.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRRD.exe.bat" "98⤵PID:2840
-
C:\windows\WRRD.exeC:\windows\WRRD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WXJRLPA.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:6048 -
C:\windows\WXJRLPA.exeC:\windows\WXJRLPA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKOB.exe.bat" "102⤵PID:480
-
C:\windows\SysWOW64\RKOB.exeC:\windows\system32\RKOB.exe103⤵
- Executes dropped EXE
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFTKGO.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\windows\LFTKGO.exeC:\windows\LFTKGO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAYPQ.exe.bat" "106⤵PID:2208
-
C:\windows\RGAYPQ.exeC:\windows\RGAYPQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGSEZ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2228 -
C:\windows\BDGSEZ.exeC:\windows\BDGSEZ.exe109⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KEIXIWP.exe.bat" "110⤵PID:5352
-
C:\windows\KEIXIWP.exeC:\windows\KEIXIWP.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUPX.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1760 -
C:\windows\system\OUPX.exeC:\windows\system\OUPX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMSQU.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\windows\system\AMSQU.exeC:\windows\system\AMSQU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUY.exe.bat" "116⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\SysWOW64\MUY.exeC:\windows\system32\MUY.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCFYTHD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5196 -
C:\windows\system\PCFYTHD.exeC:\windows\system\PCFYTHD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQF.exe.bat" "120⤵PID:3372
-
C:\windows\system\PQF.exeC:\windows\system\PQF.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-