Analysis
- max time kernel
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe
- Size 282KB
- Sample260718-bq2vxafv6t
- SHA256 bedc486096b7b2274dcc5ccc3c6a072e9913ea4fd505c1d24618c7461cd96f19
- MD5 fc515d77ea679617d25b7fa1cb41fd3f
- SHA1 e126b610440216383caf2ee30af20cce70829182
- SHA512 ca028db02eb495038c265f8592a1bb4d0945321c60cd873986bbed67982ecd5b42469297c9c2592489febdc782eabb07de16cefa59d769a898e11d8db617826b
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOxkEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOxkmZzcukG2/
- TLSH T1E1549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4108 SPSMJTZ.exe 4920 LKDC.exe 2716 FYXA.exe 5396 UTGFWWM.exe 2744 FLJYXE.exe 4432 GONTK.exe 5428 VJX.exe 3908 QXBP.exe 2876 FNCGEC.exe 1268 LNK.exe 4420 YLKGXQA.exe 3044 CBRO.exe 2440 QMHM.exe 3088 HMJSB.exe 5976 LCQ.exe 3304 UCSXRG.exe 4248 PQW.exe 5412 BGDON.exe 1964 KGFTRV.exe 4752 LJJ.exe 1472 DMNTBBZ.exe 2672 URX.exe 5144 PNCUB.exe 1968 RKIO.exe 4268 XYHPO.exe 4408 YBLT.exe 1560 WZEOOEK.exe 3620 RMBX.exe 3492 KHMBEC.exe 4496 TFSVLK.exe 3468 YQQ.exe 5048 DQYWCY.exe 5780 JQFKLA.exe 4156 HEFT.exe 4328 BEME.exe 1884 KEOJD.exe 4504 FSTSNBK.exe 576 HNYB.exe 4576 LVEJJT.exe 2316 GIJ.exe 1340 RBMM.exe 4308 BZSY.exe 5308 IUBKUW.exe 4288 YKC.exe 2888 DKKPK.exe 1436 CDVF.exe 4812 XQZPDZ.exe 2400 RDE.exe 1160 LWM.exe 5848 WPPC.exe 3108 RCTTHH.exe 4284 SANO.exe 3588 KNXGDTO.exe 6012 KTX.exe 4784 GYD.exe 5348 EYLFV.exe 3460 BEJCKTO.exe 2652 XCORRD.exe 3508 OMFPRX.exe 4464 KSL.exe 2712 TFVE.exe 2820 UIZ.exe 4380 PWEJD.exe 2740 JJITNT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\RCTTHH.exe WPPC.exe File created C:\windows\SysWOW64\KTX.exe.bat KNXGDTO.exe File created C:\windows\SysWOW64\PJANYAK.exe YWQVI.exe File opened for modification C:\windows\SysWOW64\OZDRITB.exe IMEI.exe File created C:\windows\SysWOW64\FQPGPT.exe OGYIPZ.exe File created C:\windows\SysWOW64\QXBP.exe VJX.exe File opened for modification C:\windows\SysWOW64\FLJYXE.exe UTGFWWM.exe File created C:\windows\SysWOW64\CBRO.exe YLKGXQA.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat KEOJD.exe File created C:\windows\SysWOW64\EYLFV.exe GYD.exe File created C:\windows\SysWOW64\KSL.exe.bat OMFPRX.exe File created C:\windows\SysWOW64\OZDRITB.exe.bat IMEI.exe File opened for modification C:\windows\SysWOW64\PUFFRDB.exe SOZIK.exe File opened for modification C:\windows\SysWOW64\VJX.exe GONTK.exe File opened for modification C:\windows\SysWOW64\RKIO.exe PNCUB.exe File created C:\windows\SysWOW64\RMBX.exe.bat WZEOOEK.exe File opened for modification C:\windows\SysWOW64\JOJHPGJ.exe JJITNT.exe File opened for modification C:\windows\SysWOW64\ULYK.exe FQPGPT.exe File created C:\windows\SysWOW64\PUFFRDB.exe.bat SOZIK.exe File created C:\windows\SysWOW64\FLJYXE.exe UTGFWWM.exe File created C:\windows\SysWOW64\QXBP.exe.bat VJX.exe File created C:\windows\SysWOW64\CBRO.exe.bat YLKGXQA.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe BGDON.exe File created C:\windows\SysWOW64\KGFTRV.exe.bat BGDON.exe File opened for modification C:\windows\SysWOW64\LJJ.exe KGFTRV.exe File created C:\windows\SysWOW64\RKIO.exe.bat PNCUB.exe File created C:\windows\SysWOW64\WZEOOEK.exe YBLT.exe File created C:\windows\SysWOW64\HMJSB.exe QMHM.exe File created C:\windows\SysWOW64\LJJ.exe.bat KGFTRV.exe File created C:\windows\SysWOW64\EYLFV.exe.bat GYD.exe File created C:\windows\SysWOW64\JOJHPGJ.exe.bat JJITNT.exe File created C:\windows\SysWOW64\PJANYAK.exe.bat YWQVI.exe File created C:\windows\SysWOW64\OZDRITB.exe IMEI.exe File opened for modification C:\windows\SysWOW64\ZJYTQKM.exe OQVAID.exe File opened for modification C:\windows\SysWOW64\QXBP.exe VJX.exe File created C:\windows\SysWOW64\GONTK.exe FLJYXE.exe File created C:\windows\SysWOW64\RKIO.exe PNCUB.exe File opened for modification C:\windows\SysWOW64\RMBX.exe WZEOOEK.exe File created C:\windows\SysWOW64\KNXGDTO.exe.bat SANO.exe File opened for modification C:\windows\SysWOW64\MJUP.exe ITNHTX.exe File opened for modification C:\windows\SysWOW64\BRFX.exe MWWTMMY.exe File opened for modification C:\windows\SysWOW64\VBFA.exe ANARIEB.exe File created C:\windows\SysWOW64\VJX.exe.bat GONTK.exe File opened for modification C:\windows\SysWOW64\HMJSB.exe QMHM.exe File created C:\windows\SysWOW64\BEME.exe.bat HEFT.exe File created C:\windows\SysWOW64\RCTTHH.exe WPPC.exe File created C:\windows\SysWOW64\LJJ.exe KGFTRV.exe File created C:\windows\SysWOW64\WZEOOEK.exe.bat YBLT.exe File created C:\windows\SysWOW64\RMBX.exe WZEOOEK.exe File created C:\windows\SysWOW64\ULYK.exe.bat FQPGPT.exe File created C:\windows\SysWOW64\PUFFRDB.exe SOZIK.exe File opened for modification C:\windows\SysWOW64\GONTK.exe FLJYXE.exe File created C:\windows\SysWOW64\VJX.exe GONTK.exe File created C:\windows\SysWOW64\KGFTRV.exe BGDON.exe File opened for modification C:\windows\SysWOW64\BEME.exe HEFT.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat WPPC.exe File created C:\windows\SysWOW64\KNXGDTO.exe SANO.exe File created C:\windows\SysWOW64\KTX.exe KNXGDTO.exe File opened for modification C:\windows\SysWOW64\KTX.exe KNXGDTO.exe File created C:\windows\SysWOW64\FYXA.exe LKDC.exe File created C:\windows\SysWOW64\FYXA.exe.bat LKDC.exe File created C:\windows\SysWOW64\HMJSB.exe.bat QMHM.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe KEOJD.exe File created C:\windows\SysWOW64\JOJHPGJ.exe JJITNT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YLKGXQA.exe LNK.exe File opened for modification C:\windows\system\JQFKLA.exe DQYWCY.exe File created C:\windows\LVEJJT.exe.bat HNYB.exe File created C:\windows\system\RBMM.exe.bat GIJ.exe File created C:\windows\DDDX.exe XCVB.exe File opened for modification C:\windows\system\BGDON.exe PQW.exe File created C:\windows\system\DQYWCY.exe.bat YQQ.exe File created C:\windows\WPPC.exe LWM.exe File opened for modification C:\windows\system\LKDC.exe SPSMJTZ.exe File created C:\windows\BZSY.exe RBMM.exe File opened for modification C:\windows\LWM.exe RDE.exe File opened for modification C:\windows\SANO.exe RCTTHH.exe File created C:\windows\system\BEJCKTO.exe EYLFV.exe File created C:\windows\system\PQW.exe UCSXRG.exe File opened for modification C:\windows\PNCUB.exe URX.exe File created C:\windows\LWM.exe RDE.exe File opened for modification C:\windows\TGSKOGZ.exe DLIGD.exe File opened for modification C:\windows\system\KKNUJ.exe QOI.exe File opened for modification C:\windows\system\FNCGEC.exe QXBP.exe File created C:\windows\UUMT.exe.bat PUFFRDB.exe File opened for modification C:\windows\system\YLKGXQA.exe LNK.exe File created C:\windows\system\KEOJD.exe BEME.exe File created C:\windows\IUBKUW.exe.bat BZSY.exe File opened for modification C:\windows\ITNHTX.exe PQJM.exe File created C:\windows\system\KKNUJ.exe QOI.exe File created C:\windows\PNCUB.exe URX.exe File created C:\windows\system\KHMBEC.exe RMBX.exe File created C:\windows\system\KHMBEC.exe.bat RMBX.exe File opened for modification C:\windows\system\PWEJD.exe UIZ.exe File created C:\windows\WMDIMTB.exe OHDBKG.exe File opened for modification C:\windows\system\GAWHYE.exe RXM.exe File opened for modification C:\windows\system\QMHM.exe CBRO.exe File created C:\windows\UCSXRG.exe LCQ.exe File created C:\windows\system\PQW.exe.bat UCSXRG.exe File created C:\windows\system\PWEJD.exe UIZ.exe File created C:\windows\system\HEFT.exe JQFKLA.exe File opened for modification C:\windows\PQJM.exe JQCYWEX.exe File opened for modification C:\windows\SOZIK.exe XBUY.exe File created C:\windows\WPPC.exe.bat LWM.exe File created C:\windows\system\JQCYWEX.exe.bat DDDX.exe File created C:\windows\NTXU.exe.bat TGSKOGZ.exe File created C:\windows\UTGFWWM.exe FYXA.exe File opened for modification C:\windows\DMNTBBZ.exe LJJ.exe File created C:\windows\system\UALFRNC.exe OZDRITB.exe File created C:\windows\GAN.exe.bat WMDIMTB.exe File created C:\windows\system\FNCGEC.exe.bat QXBP.exe File created C:\windows\system\LKDC.exe.bat SPSMJTZ.exe File created C:\windows\system\DQYWCY.exe YQQ.exe File created C:\windows\system\JQFKLA.exe.bat DQYWCY.exe File created C:\windows\DKKPK.exe YKC.exe File created C:\windows\MWWTMMY.exe AETAE.exe File created C:\windows\MQAFHU.exe.bat MKIQ.exe File created C:\windows\RXM.exe.bat KKNUJ.exe File created C:\windows\GIJ.exe LVEJJT.exe File created C:\windows\IUBKUW.exe BZSY.exe File created C:\windows\system\QOI.exe.bat ZJYTQKM.exe File opened for modification C:\windows\system\ANARIEB.exe GAWHYE.exe File created C:\windows\RDE.exe.bat XQZPDZ.exe File opened for modification C:\windows\LCQ.exe HMJSB.exe File created C:\windows\XYHPO.exe RKIO.exe File opened for modification C:\windows\OCZNJU.exe XRA.exe File opened for modification C:\windows\system\JQCYWEX.exe DDDX.exe File created C:\windows\DLIGD.exe UCG.exe File opened for modification C:\windows\system\NDDMH.exe ILV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 700 cmd.exe 1276 cmd.exe 4980 cmd.exe 3912 cmd.exe 676 cmd.exe 1952 cmd.exe 1256 cmd.exe 6124 cmd.exe 4224 cmd.exe 1556 cmd.exe 4684 cmd.exe 2536 cmd.exe 3548 cmd.exe 5832 cmd.exe 3388 cmd.exe 2000 cmd.exe 1412 cmd.exe 4296 cmd.exe 3828 cmd.exe 2768 cmd.exe 4788 cmd.exe 4416 cmd.exe 2328 cmd.exe 3268 cmd.exe 4580 cmd.exe 2236 cmd.exe 4736 cmd.exe 3428 cmd.exe 1456 cmd.exe 2336 cmd.exe 8 cmd.exe 4216 cmd.exe 6096 cmd.exe 2944 cmd.exe 4352 cmd.exe 6000 cmd.exe 1928 cmd.exe 4244 cmd.exe 5288 cmd.exe 3720 cmd.exe 2548 cmd.exe 3376 cmd.exe 5492 cmd.exe 5420 cmd.exe 4636 cmd.exe 5324 cmd.exe 4132 cmd.exe 2620 cmd.exe 4180 cmd.exe 2796 cmd.exe 4700 cmd.exe 2948 cmd.exe 2872 cmd.exe 4084 cmd.exe 5872 cmd.exe 2352 cmd.exe 1980 cmd.exe 4956 cmd.exe 4212 cmd.exe 4692 cmd.exe 2420 cmd.exe 4892 cmd.exe 120 cmd.exe 4424 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3472 1548 WerFault.exe 88 976 4108 WerFault.exe 93 3460 4920 WerFault.exe 99 3272 2716 WerFault.exe 104 5692 5396 WerFault.exe 109 4384 2744 WerFault.exe 114 5312 4432 WerFault.exe 119 4224 5428 WerFault.exe 124 4980 3908 WerFault.exe 129 5892 2876 WerFault.exe 134 5076 1268 WerFault.exe 139 724 4420 WerFault.exe 144 6008 3044 WerFault.exe 149 4268 2440 WerFault.exe 154 412 3088 WerFault.exe 159 2684 5976 WerFault.exe 164 3300 3304 WerFault.exe 169 3348 4248 WerFault.exe 174 2316 5412 WerFault.exe 179 4772 1964 WerFault.exe 184 1216 4752 WerFault.exe 189 2324 1472 WerFault.exe 194 4104 2672 WerFault.exe 199 5916 5144 WerFault.exe 204 1884 1968 WerFault.exe 209 788 4268 WerFault.exe 214 2684 4408 WerFault.exe 219 3300 1560 WerFault.exe 224 6052 3620 WerFault.exe 229 4732 3492 WerFault.exe 234 3152 4496 WerFault.exe 239 3952 3468 WerFault.exe 244 5544 5048 WerFault.exe 249 4784 5780 WerFault.exe 254 5716 4156 WerFault.exe 259 1492 4328 WerFault.exe 264 4764 1884 WerFault.exe 269 4700 4504 WerFault.exe 274 5808 576 WerFault.exe 279 4840 4576 WerFault.exe 284 6092 2316 WerFault.exe 289 5892 1340 WerFault.exe 294 5672 4308 WerFault.exe 299 5752 5308 WerFault.exe 304 1048 4288 WerFault.exe 309 5348 2888 WerFault.exe 314 3000 1436 WerFault.exe 319 4188 4812 WerFault.exe 324 4588 2400 WerFault.exe 329 3504 1160 WerFault.exe 334 4772 5848 WerFault.exe 339 5188 3108 WerFault.exe 344 3928 4284 WerFault.exe 349 2620 3588 WerFault.exe 354 4216 6012 WerFault.exe 359 5776 4784 WerFault.exe 364 1440 5348 WerFault.exe 369 4656 3460 WerFault.exe 374 4384 2652 WerFault.exe 379 1108 3508 WerFault.exe 384 2948 4464 WerFault.exe 389 904 2712 WerFault.exe 394 3928 2820 WerFault.exe 399 2800 4380 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCSXRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVAID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKNUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGFTRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCORRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUFFRDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEOOEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGYIPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GONTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQYWCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJANYAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLIGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RASTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMNTBBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGDON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SANO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe 1548 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe 4108 SPSMJTZ.exe 4108 SPSMJTZ.exe 4920 LKDC.exe 4920 LKDC.exe 2716 FYXA.exe 2716 FYXA.exe 5396 UTGFWWM.exe 5396 UTGFWWM.exe 2744 FLJYXE.exe 2744 FLJYXE.exe 4432 GONTK.exe 4432 GONTK.exe 5428 VJX.exe 5428 VJX.exe 3908 QXBP.exe 3908 QXBP.exe 2876 FNCGEC.exe 2876 FNCGEC.exe 1268 LNK.exe 1268 LNK.exe 4420 YLKGXQA.exe 4420 YLKGXQA.exe 3044 CBRO.exe 3044 CBRO.exe 2440 QMHM.exe 2440 QMHM.exe 3088 HMJSB.exe 3088 HMJSB.exe 5976 LCQ.exe 5976 LCQ.exe 3304 UCSXRG.exe 3304 UCSXRG.exe 4248 PQW.exe 4248 PQW.exe 5412 BGDON.exe 5412 BGDON.exe 1964 KGFTRV.exe 1964 KGFTRV.exe 4752 LJJ.exe 4752 LJJ.exe 1472 DMNTBBZ.exe 1472 DMNTBBZ.exe 2672 URX.exe 2672 URX.exe 5144 PNCUB.exe 5144 PNCUB.exe 1968 RKIO.exe 1968 RKIO.exe 4268 XYHPO.exe 4268 XYHPO.exe 4408 YBLT.exe 4408 YBLT.exe 1560 WZEOOEK.exe 1560 WZEOOEK.exe 3620 RMBX.exe 3620 RMBX.exe 3492 KHMBEC.exe 3492 KHMBEC.exe 4496 TFSVLK.exe 4496 TFSVLK.exe 3468 YQQ.exe 3468 YQQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1548 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe 1548 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe 4108 SPSMJTZ.exe 4108 SPSMJTZ.exe 4920 LKDC.exe 4920 LKDC.exe 2716 FYXA.exe 2716 FYXA.exe 5396 UTGFWWM.exe 5396 UTGFWWM.exe 2744 FLJYXE.exe 2744 FLJYXE.exe 4432 GONTK.exe 4432 GONTK.exe 5428 VJX.exe 5428 VJX.exe 3908 QXBP.exe 3908 QXBP.exe 2876 FNCGEC.exe 2876 FNCGEC.exe 1268 LNK.exe 1268 LNK.exe 4420 YLKGXQA.exe 4420 YLKGXQA.exe 3044 CBRO.exe 3044 CBRO.exe 2440 QMHM.exe 2440 QMHM.exe 3088 HMJSB.exe 3088 HMJSB.exe 5976 LCQ.exe 5976 LCQ.exe 3304 UCSXRG.exe 3304 UCSXRG.exe 4248 PQW.exe 4248 PQW.exe 5412 BGDON.exe 5412 BGDON.exe 1964 KGFTRV.exe 1964 KGFTRV.exe 4752 LJJ.exe 4752 LJJ.exe 1472 DMNTBBZ.exe 1472 DMNTBBZ.exe 2672 URX.exe 2672 URX.exe 5144 PNCUB.exe 5144 PNCUB.exe 1968 RKIO.exe 1968 RKIO.exe 4268 XYHPO.exe 4268 XYHPO.exe 4408 YBLT.exe 4408 YBLT.exe 1560 WZEOOEK.exe 1560 WZEOOEK.exe 3620 RMBX.exe 3620 RMBX.exe 3492 KHMBEC.exe 3492 KHMBEC.exe 4496 TFSVLK.exe 4496 TFSVLK.exe 3468 YQQ.exe 3468 YQQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 4128 1548 2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe 89 PID 4128 wrote to memory of 4108 4128 cmd.exe 93 PID 4108 wrote to memory of 3160 4108 SPSMJTZ.exe 95 PID 3160 wrote to memory of 4920 3160 cmd.exe 99 PID 4920 wrote to memory of 912 4920 LKDC.exe 100 PID 912 wrote to memory of 2716 912 cmd.exe 104 PID 2716 wrote to memory of 5404 2716 FYXA.exe 105 PID 5404 wrote to memory of 5396 5404 cmd.exe 109 PID 5396 wrote to memory of 1580 5396 UTGFWWM.exe 110 PID 1580 wrote to memory of 2744 1580 cmd.exe 114 PID 2744 wrote to memory of 1476 2744 FLJYXE.exe 115 PID 1476 wrote to memory of 4432 1476 cmd.exe 119 PID 4432 wrote to memory of 1324 4432 GONTK.exe 120 PID 1324 wrote to memory of 5428 1324 cmd.exe 124 PID 5428 wrote to memory of 2248 5428 VJX.exe 125 PID 2248 wrote to memory of 3908 2248 cmd.exe 129 PID 3908 wrote to memory of 2348 3908 QXBP.exe 130 PID 2348 wrote to memory of 2876 2348 cmd.exe 134 PID 2876 wrote to memory of 4148 2876 FNCGEC.exe 135 PID 4148 wrote to memory of 1268 4148 cmd.exe 139 PID 1268 wrote to memory of 4244 1268 LNK.exe 140 PID 4244 wrote to memory of 4420 4244 cmd.exe 144 PID 4420 wrote to memory of 5288 4420 YLKGXQA.exe 145 PID 5288 wrote to memory of 3044 5288 cmd.exe 149 PID 3044 wrote to memory of 4580 3044 CBRO.exe 150 PID 4580 wrote to memory of 2440 4580 cmd.exe 154 PID 2440 wrote to memory of 700 2440 QMHM.exe 155 PID 700 wrote to memory of 3088 700 cmd.exe 159 PID 3088 wrote to memory of 3024 3088 HMJSB.exe 160 PID 3024 wrote to memory of 5976 3024 cmd.exe 164 PID 5976 wrote to memory of 5516 5976 LCQ.exe 165 PID 5516 wrote to memory of 3304 5516 cmd.exe 169 PID 3304 wrote to memory of 2376 3304 UCSXRG.exe 170 PID 2376 wrote to memory of 4248 2376 cmd.exe 174 PID 4248 wrote to memory of 3148 4248 PQW.exe 175 PID 3148 wrote to memory of 5412 3148 cmd.exe 179 PID 5412 wrote to memory of 4844 5412 BGDON.exe 180 PID 4844 wrote to memory of 1964 4844 cmd.exe 184 PID 1964 wrote to memory of 2700 1964 KGFTRV.exe 185 PID 2700 wrote to memory of 4752 2700 cmd.exe 189 PID 4752 wrote to memory of 1432 4752 LJJ.exe 190 PID 1432 wrote to memory of 1472 1432 cmd.exe 194 PID 1472 wrote to memory of 4956 1472 DMNTBBZ.exe 195 PID 4956 wrote to memory of 2672 4956 cmd.exe 199 PID 2672 wrote to memory of 2776 2672 URX.exe 200 PID 2776 wrote to memory of 5144 2776 cmd.exe 204 PID 5144 wrote to memory of 2344 5144 PNCUB.exe 205 PID 2344 wrote to memory of 1968 2344 cmd.exe 209 PID 1968 wrote to memory of 4088 1968 RKIO.exe 210 PID 4088 wrote to memory of 4268 4088 cmd.exe 214 PID 4268 wrote to memory of 4296 4268 XYHPO.exe 215 PID 4296 wrote to memory of 4408 4296 cmd.exe 219 PID 4408 wrote to memory of 3720 4408 YBLT.exe 220 PID 3720 wrote to memory of 1560 3720 cmd.exe 224 PID 1560 wrote to memory of 4888 1560 WZEOOEK.exe 225 PID 4888 wrote to memory of 3620 4888 cmd.exe 229 PID 3620 wrote to memory of 1932 3620 RMBX.exe 230 PID 1932 wrote to memory of 3492 1932 cmd.exe 234 PID 3492 wrote to memory of 5036 3492 KHMBEC.exe 235 PID 5036 wrote to memory of 4496 5036 cmd.exe 239 PID 4496 wrote to memory of 4224 4496 TFSVLK.exe 240 PID 4224 wrote to memory of 3468 4224 cmd.exe 244 PID 3468 wrote to memory of 2508 3468 YQQ.exe 245 PID 2508 wrote to memory of 5048 2508 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_fc515d77ea679617d25b7fa1cb41fd3f_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPSMJTZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\system\SPSMJTZ.exeC:\windows\system\SPSMJTZ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTGFWWM.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\UTGFWWM.exeC:\windows\UTGFWWM.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLJYXE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\SysWOW64\FLJYXE.exeC:\windows\system32\FLJYXE.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\SysWOW64\VJX.exeC:\windows\system32\VJX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXBP.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\SysWOW64\QXBP.exeC:\windows\system32\QXBP.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\LNK.exeC:\windows\LNK.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMHM.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\QMHM.exeC:\windows\system\QMHM.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\LCQ.exeC:\windows\LCQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGDON.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\system\BGDON.exeC:\windows\system\BGDON.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\URX.exeC:\windows\system\URX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNCUB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\PNCUB.exeC:\windows\PNCUB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKIO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\SysWOW64\RKIO.exeC:\windows\system32\RKIO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\YBLT.exeC:\windows\YBLT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\YQQ.exeC:\windows\YQQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "66⤵PID:5280
-
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFT.exe.bat" "68⤵PID:3144
-
C:\windows\system\HEFT.exeC:\windows\system\HEFT.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "70⤵PID:2988
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KEOJD.exe.bat" "72⤵PID:4604
-
C:\windows\system\KEOJD.exeC:\windows\system\KEOJD.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "74⤵PID:2372
-
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe75⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "76⤵PID:2288
-
C:\windows\HNYB.exeC:\windows\HNYB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVEJJT.exe.bat" "78⤵PID:5000
-
C:\windows\LVEJJT.exeC:\windows\LVEJJT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "80⤵PID:2116
-
C:\windows\GIJ.exeC:\windows\GIJ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBMM.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2548 -
C:\windows\system\RBMM.exeC:\windows\system\RBMM.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZSY.exe.bat" "84⤵PID:3788
-
C:\windows\BZSY.exeC:\windows\BZSY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUBKUW.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1412 -
C:\windows\IUBKUW.exeC:\windows\IUBKUW.exe87⤵
- Executes dropped EXE
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3376 -
C:\windows\system\YKC.exeC:\windows\system\YKC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKKPK.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\windows\DKKPK.exeC:\windows\DKKPK.exe91⤵
- Executes dropped EXE
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:8 -
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe93⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQZPDZ.exe.bat" "94⤵PID:1368
-
C:\windows\system\XQZPDZ.exeC:\windows\system\XQZPDZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\windows\RDE.exeC:\windows\RDE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\windows\LWM.exeC:\windows\LWM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\windows\WPPC.exeC:\windows\WPPC.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "102⤵PID:3348
-
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SANO.exe.bat" "104⤵PID:3756
-
C:\windows\SANO.exeC:\windows\SANO.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNXGDTO.exe.bat" "106⤵PID:2804
-
C:\windows\SysWOW64\KNXGDTO.exeC:\windows\system32\KNXGDTO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTX.exe.bat" "108⤵PID:4640
-
C:\windows\SysWOW64\KTX.exeC:\windows\system32\KTX.exe109⤵
- Executes dropped EXE
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1892 -
C:\windows\GYD.exeC:\windows\GYD.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "112⤵PID:2340
-
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEJCKTO.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2236 -
C:\windows\system\BEJCKTO.exeC:\windows\system\BEJCKTO.exe115⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCORRD.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4144 -
C:\windows\system\XCORRD.exeC:\windows\system\XCORRD.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMFPRX.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\windows\OMFPRX.exeC:\windows\OMFPRX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSL.exe.bat" "120⤵PID:5736
-
C:\windows\SysWOW64\KSL.exeC:\windows\system32\KSL.exe121⤵
- Executes dropped EXE
PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-