Analysis
- max time kernel
44s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe
- Size 208KB
- Sample260810-1yllbsvscz
- SHA256 55eaf3c8d74887fda3110e872e10b4c892148da013845f66494168ebfa537c7e
- MD5 9e4e44fc272384c2338b7333d182e91c
- SHA1 c46b8eda32a49c043d5411ba1d962d658d26ad56
- SHA512 0f480aa01c5a5f9b873b524b5f18a93532f8426e13e096cc12844c205da1f09d344507cbab580c85866e5bf737324a57d7307e396d63ddd16e1674c981662c75
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOf84pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOUkEj1
- TLSH T1F3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 55 IoCs
pid Process 1672 MTYM.exe 2464 FPKCMLJ.exe 5516 KHGEZ.exe 3852 JAJU.exe 1804 TYO.exe 4144 MQE.exe 4784 KMDA.exe 3832 DEKL.exe 1008 TUTDUHS.exe 3780 XCALG.exe 1256 IVVDOH.exe 2564 ZNSCHC.exe 2232 QWU.exe 6020 SUACAQP.exe 4200 VHEL.exe 5576 PUJUUQ.exe 5792 IXN.exe 1756 SVBKHOD.exe 612 BVV.exe 2176 GBNN.exe 4304 GONTK.exe 3828 ZJRXQKE.exe 3484 ZMVTV.exe 3680 DDB.exe 5852 YQGKR.exe 5956 CYNKEKM.exe 5844 CBRO.exe 5876 GJX.exe 5984 HMJSB.exe 4812 GXMI.exe 4604 YAQDPM.exe 5996 PNAV.exe 3288 UQYQFCH.exe 5948 DDJ.exe 4520 DYMEAO.exe 2996 WCQ.exe 560 XFUETCH.exe 2608 BNJMF.exe 3496 KVDRJS.exe 5160 FGTH.exe 2896 UDZEEE.exe 1968 WZEOOEK.exe 4512 PUIS.exe 4280 YCK.exe 3008 SUFP.exe 2436 BAPHV.exe 5540 DYQCT.exe 3056 OQLUCI.exe 980 DLDH.exe 1760 MTXMY.exe 2580 SUE.exe 5072 SZE.exe 5000 PFK.exe 5228 VFSZH.exe 5192 XDLTFI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\UQYQFCH.exe.bat PNAV.exe File created C:\windows\SysWOW64\KHGEZ.exe.bat FPKCMLJ.exe File opened for modification C:\windows\SysWOW64\BVV.exe SVBKHOD.exe File created C:\windows\SysWOW64\CYNKEKM.exe.bat YQGKR.exe File created C:\windows\SysWOW64\HMJSB.exe GJX.exe File created C:\windows\SysWOW64\HMJSB.exe.bat GJX.exe File created C:\windows\SysWOW64\DYMEAO.exe.bat DDJ.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat QWU.exe File opened for modification C:\windows\SysWOW64\MTYM.exe 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe File created C:\windows\SysWOW64\TUTDUHS.exe DEKL.exe File created C:\windows\SysWOW64\PNAV.exe.bat YAQDPM.exe File created C:\windows\SysWOW64\GBNN.exe.bat BVV.exe File opened for modification C:\windows\SysWOW64\GONTK.exe GBNN.exe File opened for modification C:\windows\SysWOW64\HMJSB.exe GJX.exe File created C:\windows\SysWOW64\SVBKHOD.exe IXN.exe File created C:\windows\SysWOW64\CBRO.exe.bat CYNKEKM.exe File created C:\windows\SysWOW64\DYMEAO.exe DDJ.exe File opened for modification C:\windows\SysWOW64\FGTH.exe KVDRJS.exe File opened for modification C:\windows\SysWOW64\YCK.exe PUIS.exe File opened for modification C:\windows\SysWOW64\DYMEAO.exe DDJ.exe File opened for modification C:\windows\SysWOW64\MQE.exe TYO.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe QWU.exe File opened for modification C:\windows\SysWOW64\GBNN.exe BVV.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe GXMI.exe File created C:\windows\SysWOW64\UQYQFCH.exe PNAV.exe File created C:\windows\SysWOW64\YCK.exe.bat PUIS.exe File opened for modification C:\windows\SysWOW64\OQLUCI.exe DYQCT.exe File created C:\windows\SysWOW64\IXN.exe.bat PUJUUQ.exe File created C:\windows\SysWOW64\MQE.exe TYO.exe File created C:\windows\SysWOW64\MQE.exe.bat TYO.exe File created C:\windows\SysWOW64\TUTDUHS.exe.bat DEKL.exe File created C:\windows\SysWOW64\GBNN.exe BVV.exe File opened for modification C:\windows\SysWOW64\CBRO.exe CYNKEKM.exe File created C:\windows\SysWOW64\WCQ.exe DYMEAO.exe File created C:\windows\SysWOW64\WCQ.exe.bat DYMEAO.exe File created C:\windows\SysWOW64\MTYM.exe 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\DEKL.exe KMDA.exe File opened for modification C:\windows\SysWOW64\XFUETCH.exe WCQ.exe File created C:\windows\SysWOW64\KVDRJS.exe BNJMF.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe BNJMF.exe File created C:\windows\SysWOW64\FGTH.exe.bat KVDRJS.exe File created C:\windows\SysWOW64\YCK.exe PUIS.exe File created C:\windows\SysWOW64\OQLUCI.exe DYQCT.exe File opened for modification C:\windows\SysWOW64\IXN.exe PUJUUQ.exe File created C:\windows\SysWOW64\BVV.exe SVBKHOD.exe File opened for modification C:\windows\SysWOW64\CYNKEKM.exe YQGKR.exe File opened for modification C:\windows\SysWOW64\WCQ.exe DYMEAO.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat BNJMF.exe File created C:\windows\SysWOW64\OQLUCI.exe.bat DYQCT.exe File created C:\windows\SysWOW64\SZE.exe SUE.exe File created C:\windows\SysWOW64\XDLTFI.exe VFSZH.exe File created C:\windows\SysWOW64\MTYM.exe.bat 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe File created C:\windows\SysWOW64\KHGEZ.exe FPKCMLJ.exe File created C:\windows\SysWOW64\DEKL.exe KMDA.exe File created C:\windows\SysWOW64\GONTK.exe GBNN.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat WCQ.exe File created C:\windows\SysWOW64\SZE.exe.bat SUE.exe File opened for modification C:\windows\SysWOW64\KHGEZ.exe FPKCMLJ.exe File created C:\windows\SysWOW64\GONTK.exe.bat GBNN.exe File created C:\windows\SysWOW64\CYNKEKM.exe YQGKR.exe File created C:\windows\SysWOW64\YAQDPM.exe GXMI.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe UDZEEE.exe File opened for modification C:\windows\SysWOW64\SUE.exe MTXMY.exe File opened for modification C:\windows\SysWOW64\SZE.exe SUE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\MTXMY.exe DLDH.exe File created C:\windows\PFK.exe SZE.exe File opened for modification C:\windows\PFK.exe SZE.exe File created C:\windows\PFK.exe.bat SZE.exe File created C:\windows\PUJUUQ.exe.bat VHEL.exe File created C:\windows\DDJ.exe UQYQFCH.exe File created C:\windows\FPKCMLJ.exe.bat MTYM.exe File created C:\windows\system\IVVDOH.exe.bat XCALG.exe File created C:\windows\QWU.exe ZNSCHC.exe File opened for modification C:\windows\VHEL.exe SUACAQP.exe File created C:\windows\PUJUUQ.exe VHEL.exe File opened for modification C:\windows\system\BAPHV.exe SUFP.exe File created C:\windows\DYQCT.exe.bat BAPHV.exe File created C:\windows\VFSZH.exe.bat PFK.exe File opened for modification C:\windows\FPKCMLJ.exe MTYM.exe File opened for modification C:\windows\ZNSCHC.exe MLK.exe File created C:\windows\DDJ.exe.bat UQYQFCH.exe File created C:\windows\PUIS.exe.bat WZEOOEK.exe File created C:\windows\SUFP.exe YCK.exe File created C:\windows\SUFP.exe.bat YCK.exe File created C:\windows\system\BAPHV.exe.bat SUFP.exe File created C:\windows\system\TYO.exe JAJU.exe File opened for modification C:\windows\system\YQGKR.exe DDB.exe File created C:\windows\GJX.exe CBRO.exe File created C:\windows\DYQCT.exe BAPHV.exe File opened for modification C:\windows\system\GXMI.exe HMJSB.exe File created C:\windows\FPKCMLJ.exe MTYM.exe File opened for modification C:\windows\system\TYO.exe JAJU.exe File created C:\windows\QWU.exe.bat ZNSCHC.exe File created C:\windows\system\YQGKR.exe.bat DDB.exe File opened for modification C:\windows\system\DLDH.exe OQLUCI.exe File created C:\windows\JAJU.exe KHGEZ.exe File created C:\windows\ZNSCHC.exe MLK.exe File opened for modification C:\windows\PUJUUQ.exe VHEL.exe File opened for modification C:\windows\ZJRXQKE.exe GONTK.exe File created C:\windows\system\ZMVTV.exe ZJRXQKE.exe File opened for modification C:\windows\BNJMF.exe XFUETCH.exe File created C:\windows\system\BAPHV.exe SUFP.exe File opened for modification C:\windows\PUIS.exe WZEOOEK.exe File created C:\windows\JAJU.exe.bat KHGEZ.exe File created C:\windows\VHEL.exe SUACAQP.exe File opened for modification C:\windows\DDJ.exe UQYQFCH.exe File created C:\windows\MTXMY.exe DLDH.exe File opened for modification C:\windows\JAJU.exe KHGEZ.exe File opened for modification C:\windows\system\IVVDOH.exe XCALG.exe File created C:\windows\system\DDB.exe.bat ZMVTV.exe File created C:\windows\system\YQGKR.exe DDB.exe File created C:\windows\system\ZMVTV.exe.bat ZJRXQKE.exe File created C:\windows\system\DDB.exe ZMVTV.exe File created C:\windows\system\GXMI.exe.bat HMJSB.exe File created C:\windows\MTXMY.exe.bat DLDH.exe File created C:\windows\system\KMDA.exe.bat MQE.exe File opened for modification C:\windows\QWU.exe ZNSCHC.exe File created C:\windows\system\UDZEEE.exe FGTH.exe File opened for modification C:\windows\SUFP.exe YCK.exe File opened for modification C:\windows\DYQCT.exe BAPHV.exe File created C:\windows\system\DLDH.exe OQLUCI.exe File created C:\windows\GJX.exe.bat CBRO.exe File created C:\windows\system\KMDA.exe MQE.exe File created C:\windows\VHEL.exe.bat SUACAQP.exe File created C:\windows\system\GXMI.exe HMJSB.exe File created C:\windows\BNJMF.exe.bat XFUETCH.exe File created C:\windows\PUIS.exe WZEOOEK.exe File created C:\windows\system\TYO.exe.bat JAJU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2920 cmd.exe 5284 cmd.exe 5108 cmd.exe 2364 cmd.exe 2980 cmd.exe 3972 cmd.exe 2420 cmd.exe 4652 cmd.exe 3624 cmd.exe 236 cmd.exe 5904 cmd.exe 2844 cmd.exe 2412 cmd.exe 2908 cmd.exe 5912 cmd.exe 5056 cmd.exe 5372 cmd.exe 3428 cmd.exe 1124 cmd.exe 1388 cmd.exe 4684 cmd.exe 4880 cmd.exe 5412 cmd.exe 2356 cmd.exe 2904 cmd.exe 5400 cmd.exe 3844 cmd.exe 2032 cmd.exe 4372 cmd.exe 4108 cmd.exe 1292 cmd.exe 2744 cmd.exe 2548 cmd.exe 3728 cmd.exe 5556 cmd.exe 1096 cmd.exe 2640 cmd.exe 4348 cmd.exe 5168 cmd.exe 3416 cmd.exe 4980 cmd.exe 1080 cmd.exe 4228 cmd.exe 3320 cmd.exe 2684 cmd.exe 4824 cmd.exe 2300 cmd.exe 5820 cmd.exe 1800 cmd.exe 4272 cmd.exe 3380 cmd.exe 1304 cmd.exe 5364 cmd.exe 2472 cmd.exe 3880 cmd.exe 4860 cmd.exe 4740 cmd.exe 2388 cmd.exe 5664 cmd.exe 1160 cmd.exe 4172 cmd.exe 3384 cmd.exe 2700 cmd.exe 2044 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5496 4516 WerFault.exe 87 3924 1672 WerFault.exe 93 2252 2464 WerFault.exe 99 2972 5516 WerFault.exe 104 5908 3852 WerFault.exe 109 4256 1804 WerFault.exe 114 1840 4144 WerFault.exe 119 4148 4784 WerFault.exe 124 5488 3832 WerFault.exe 129 5992 1008 WerFault.exe 134 4340 3780 WerFault.exe 139 416 1256 WerFault.exe 144 6032 1456 WerFault.exe 149 4980 2564 WerFault.exe 154 5524 2232 WerFault.exe 159 5624 6020 WerFault.exe 164 5844 4200 WerFault.exe 169 1332 5576 WerFault.exe 174 1324 5792 WerFault.exe 179 2256 1756 WerFault.exe 184 4192 612 WerFault.exe 189 2832 2176 WerFault.exe 194 1580 4304 WerFault.exe 199 4940 3828 WerFault.exe 204 3716 3484 WerFault.exe 209 5404 3680 WerFault.exe 214 6036 5852 WerFault.exe 219 560 5956 WerFault.exe 224 1332 5844 WerFault.exe 229 1424 5876 WerFault.exe 234 5800 5984 WerFault.exe 239 4180 4812 WerFault.exe 244 1584 4604 WerFault.exe 249 1084 5996 WerFault.exe 254 2408 3288 WerFault.exe 259 3384 5948 WerFault.exe 264 1504 4520 WerFault.exe 269 5448 2996 WerFault.exe 275 5468 560 WerFault.exe 280 2820 2608 WerFault.exe 285 3012 3496 WerFault.exe 290 2524 5160 WerFault.exe 295 3436 2896 WerFault.exe 300 3004 1968 WerFault.exe 305 236 4512 WerFault.exe 310 2904 4280 WerFault.exe 315 2356 3008 WerFault.exe 320 1496 2436 WerFault.exe 325 2444 5540 WerFault.exe 330 4708 3056 WerFault.exe 334 4632 980 WerFault.exe 340 2340 1760 WerFault.exe 345 2432 2580 WerFault.exe 349 4296 5072 WerFault.exe 355 2972 5000 WerFault.exe 359 4128 5228 WerFault.exe 365 2604 5192 WerFault.exe 370 3404 1884 WerFault.exe 374 5616 2956 WerFault.exe 380 3700 2240 WerFault.exe 385 2804 5244 WerFault.exe 390 2472 4792 WerFault.exe 395 240 3632 WerFault.exe 400 5512 5544 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFSZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYNKEKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQLUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQYQFCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAPHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GONTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNSCHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUACAQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMVTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDZEEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEOOEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDLTFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDRJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCALG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTXMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFUETCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMDA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4516 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe 4516 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe 1672 MTYM.exe 1672 MTYM.exe 2464 FPKCMLJ.exe 2464 FPKCMLJ.exe 5516 KHGEZ.exe 5516 KHGEZ.exe 3852 JAJU.exe 3852 JAJU.exe 1804 TYO.exe 1804 TYO.exe 4144 MQE.exe 4144 MQE.exe 4784 KMDA.exe 4784 KMDA.exe 3832 DEKL.exe 3832 DEKL.exe 1008 TUTDUHS.exe 1008 TUTDUHS.exe 3780 XCALG.exe 3780 XCALG.exe 1456 MLK.exe 1456 MLK.exe 2564 ZNSCHC.exe 2564 ZNSCHC.exe 2232 QWU.exe 2232 QWU.exe 6020 SUACAQP.exe 6020 SUACAQP.exe 4200 VHEL.exe 4200 VHEL.exe 5576 PUJUUQ.exe 5576 PUJUUQ.exe 5792 IXN.exe 5792 IXN.exe 1756 SVBKHOD.exe 1756 SVBKHOD.exe 612 BVV.exe 612 BVV.exe 2176 GBNN.exe 2176 GBNN.exe 4304 GONTK.exe 4304 GONTK.exe 3828 ZJRXQKE.exe 3828 ZJRXQKE.exe 3484 ZMVTV.exe 3484 ZMVTV.exe 3680 DDB.exe 3680 DDB.exe 5852 YQGKR.exe 5852 YQGKR.exe 5956 CYNKEKM.exe 5956 CYNKEKM.exe 5844 CBRO.exe 5844 CBRO.exe 5876 GJX.exe 5876 GJX.exe 5984 HMJSB.exe 5984 HMJSB.exe 4812 GXMI.exe 4812 GXMI.exe 4604 YAQDPM.exe 4604 YAQDPM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4516 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe 4516 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe 1672 MTYM.exe 1672 MTYM.exe 2464 FPKCMLJ.exe 2464 FPKCMLJ.exe 5516 KHGEZ.exe 5516 KHGEZ.exe 3852 JAJU.exe 3852 JAJU.exe 1804 TYO.exe 1804 TYO.exe 4144 MQE.exe 4144 MQE.exe 4784 KMDA.exe 4784 KMDA.exe 3832 DEKL.exe 3832 DEKL.exe 1008 TUTDUHS.exe 1008 TUTDUHS.exe 3780 XCALG.exe 3780 XCALG.exe 1456 MLK.exe 1456 MLK.exe 2564 ZNSCHC.exe 2564 ZNSCHC.exe 2232 QWU.exe 2232 QWU.exe 6020 SUACAQP.exe 6020 SUACAQP.exe 4200 VHEL.exe 4200 VHEL.exe 5576 PUJUUQ.exe 5576 PUJUUQ.exe 5792 IXN.exe 5792 IXN.exe 1756 SVBKHOD.exe 1756 SVBKHOD.exe 612 BVV.exe 612 BVV.exe 2176 GBNN.exe 2176 GBNN.exe 4304 GONTK.exe 4304 GONTK.exe 3828 ZJRXQKE.exe 3828 ZJRXQKE.exe 3484 ZMVTV.exe 3484 ZMVTV.exe 3680 DDB.exe 3680 DDB.exe 5852 YQGKR.exe 5852 YQGKR.exe 5956 CYNKEKM.exe 5956 CYNKEKM.exe 5844 CBRO.exe 5844 CBRO.exe 5876 GJX.exe 5876 GJX.exe 5984 HMJSB.exe 5984 HMJSB.exe 4812 GXMI.exe 4812 GXMI.exe 4604 YAQDPM.exe 4604 YAQDPM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 3772 4516 2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe 89 PID 3772 wrote to memory of 1672 3772 cmd.exe 93 PID 1672 wrote to memory of 4236 1672 MTYM.exe 95 PID 4236 wrote to memory of 2464 4236 cmd.exe 99 PID 2464 wrote to memory of 2264 2464 FPKCMLJ.exe 100 PID 2264 wrote to memory of 5516 2264 cmd.exe 104 PID 5516 wrote to memory of 4872 5516 KHGEZ.exe 105 PID 4872 wrote to memory of 3852 4872 cmd.exe 109 PID 3852 wrote to memory of 2276 3852 JAJU.exe 110 PID 2276 wrote to memory of 1804 2276 cmd.exe 114 PID 1804 wrote to memory of 5888 1804 TYO.exe 115 PID 5888 wrote to memory of 4144 5888 cmd.exe 119 PID 4144 wrote to memory of 5112 4144 MQE.exe 120 PID 5112 wrote to memory of 4784 5112 cmd.exe 124 PID 4784 wrote to memory of 4240 4784 KMDA.exe 125 PID 4240 wrote to memory of 3832 4240 cmd.exe 129 PID 3832 wrote to memory of 4580 3832 DEKL.exe 130 PID 4580 wrote to memory of 1008 4580 cmd.exe 134 PID 1008 wrote to memory of 4824 1008 TUTDUHS.exe 135 PID 4824 wrote to memory of 3780 4824 cmd.exe 139 PID 3780 wrote to memory of 900 3780 XCALG.exe 140 PID 900 wrote to memory of 1256 900 cmd.exe 144 PID 1404 wrote to memory of 1456 1404 cmd.exe 149 PID 1456 wrote to memory of 1236 1456 MLK.exe 150 PID 1236 wrote to memory of 2564 1236 cmd.exe 154 PID 2564 wrote to memory of 3728 2564 ZNSCHC.exe 155 PID 3728 wrote to memory of 2232 3728 cmd.exe 159 PID 2232 wrote to memory of 3424 2232 QWU.exe 160 PID 3424 wrote to memory of 6020 3424 cmd.exe 164 PID 6020 wrote to memory of 2412 6020 SUACAQP.exe 165 PID 2412 wrote to memory of 4200 2412 cmd.exe 169 PID 4200 wrote to memory of 5352 4200 VHEL.exe 170 PID 5352 wrote to memory of 5576 5352 cmd.exe 174 PID 5576 wrote to memory of 4224 5576 PUJUUQ.exe 175 PID 4224 wrote to memory of 5792 4224 cmd.exe 179 PID 5792 wrote to memory of 4776 5792 IXN.exe 180 PID 4776 wrote to memory of 1756 4776 cmd.exe 184 PID 1756 wrote to memory of 1388 1756 SVBKHOD.exe 185 PID 1388 wrote to memory of 612 1388 cmd.exe 189 PID 612 wrote to memory of 5932 612 BVV.exe 190 PID 5932 wrote to memory of 2176 5932 cmd.exe 194 PID 2176 wrote to memory of 3416 2176 GBNN.exe 195 PID 3416 wrote to memory of 4304 3416 cmd.exe 199 PID 4304 wrote to memory of 2032 4304 GONTK.exe 200 PID 2032 wrote to memory of 3828 2032 cmd.exe 204 PID 3828 wrote to memory of 5328 3828 ZJRXQKE.exe 205 PID 5328 wrote to memory of 3484 5328 cmd.exe 209 PID 3484 wrote to memory of 5420 3484 ZMVTV.exe 210 PID 5420 wrote to memory of 3680 5420 cmd.exe 214 PID 3680 wrote to memory of 1176 3680 DDB.exe 215 PID 1176 wrote to memory of 5852 1176 cmd.exe 219 PID 5852 wrote to memory of 3380 5852 YQGKR.exe 220 PID 3380 wrote to memory of 5956 3380 cmd.exe 224 PID 5956 wrote to memory of 4664 5956 CYNKEKM.exe 225 PID 4664 wrote to memory of 5844 4664 cmd.exe 229 PID 5844 wrote to memory of 5356 5844 CBRO.exe 230 PID 5356 wrote to memory of 5876 5356 cmd.exe 234 PID 5876 wrote to memory of 5472 5876 GJX.exe 235 PID 5472 wrote to memory of 5984 5472 cmd.exe 239 PID 5984 wrote to memory of 5508 5984 HMJSB.exe 240 PID 5508 wrote to memory of 4812 5508 cmd.exe 244 PID 4812 wrote to memory of 2364 4812 GXMI.exe 245 PID 2364 wrote to memory of 4604 2364 cmd.exe 249 PID 4604 wrote to memory of 2832 4604 YAQDPM.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9e4e44fc272384c2338b7333d182e91c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTYM.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\SysWOW64\MTYM.exeC:\windows\system32\MTYM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPKCMLJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\FPKCMLJ.exeC:\windows\FPKCMLJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHGEZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\SysWOW64\KHGEZ.exeC:\windows\system32\KHGEZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAJU.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\windows\JAJU.exeC:\windows\JAJU.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TYO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\TYO.exeC:\windows\system\TYO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\SysWOW64\MQE.exeC:\windows\system32\MQE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMDA.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\windows\system\KMDA.exeC:\windows\system\KMDA.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEKL.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\DEKL.exeC:\windows\system32\DEKL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCALG.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\XCALG.exeC:\windows\system32\XCALG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVVDOH.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900 -
C:\windows\system\IVVDOH.exeC:\windows\system\IVVDOH.exe23⤵
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\windows\MLK.exeC:\windows\MLK.exe25⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QWU.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\QWU.exeC:\windows\QWU.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHEL.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\VHEL.exeC:\windows\VHEL.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXN.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\IXN.exeC:\windows\system32\IXN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVV.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\SysWOW64\BVV.exeC:\windows\system32\BVV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMVTV.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\system\ZMVTV.exeC:\windows\system\ZMVTV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQGKR.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\system\YQGKR.exeC:\windows\system\YQGKR.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYNKEKM.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\SysWOW64\CYNKEKM.exeC:\windows\system32\CYNKEKM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\GJX.exeC:\windows\GJX.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJSB.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\SysWOW64\HMJSB.exeC:\windows\system32\HMJSB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "66⤵PID:2832
-
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQYQFCH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\SysWOW64\UQYQFCH.exeC:\windows\system32\UQYQFCH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDJ.exe.bat" "70⤵PID:3924
-
C:\windows\DDJ.exeC:\windows\DDJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYMEAO.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\SysWOW64\DYMEAO.exeC:\windows\system32\DYMEAO.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4456 -
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "80⤵PID:5012
-
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "82⤵PID:2660
-
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDZEEE.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2988 -
C:\windows\system\UDZEEE.exeC:\windows\system\UDZEEE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUIS.exe.bat" "88⤵PID:1688
-
C:\windows\PUIS.exeC:\windows\PUIS.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCK.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4684 -
C:\windows\SysWOW64\YCK.exeC:\windows\system32\YCK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUFP.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\windows\SUFP.exeC:\windows\SUFP.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "96⤵PID:4072
-
C:\windows\DYQCT.exeC:\windows\DYQCT.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4172 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "100⤵PID:3856
-
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5556 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2300 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "106⤵PID:3452
-
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFK.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\windows\PFK.exeC:\windows\PFK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\VFSZH.exeC:\windows\VFSZH.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "112⤵PID:3168
-
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4372 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe115⤵PID:1884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEVMA.exe.bat" "116⤵PID:4840
-
C:\windows\system\MEVMA.exeC:\windows\system\MEVMA.exe117⤵PID:2956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "118⤵PID:4592
-
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe119⤵PID:2240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "120⤵PID:5916
-
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe121⤵PID:5244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-