Analysis
- max time kernel
74s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe
- Size 208KB
- Sample260813-akpgysff68
- SHA256 fba2c55181197dc5f15a09dd69e99501219da73e0211265448ce79cc21d95537
- MD5 bc4c2f7b3b6ddb2cc794cf314cb91f94
- SHA1 ec4b90f2c3a5611716c478171b91842f9f61051b
- SHA512 40dd35e32f05e0e0e6f9cff03af9e3063198512b4c01e5f45646f7931cc4174578b9f60284eaa30b5a49e9e69da54cb5a14c6337de99e9639e0e0d295e88b3fa
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfB4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO5kEj1
- TLSH T1E4247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5904 RNNSX.exe 1192 WJFSGWY.exe 4816 ZRO.exe 5688 JPGBE.exe 5880 FPQDQO.exe 5952 EATTQ.exe 4844 HNK.exe 1476 KVLRR.exe 1508 IOVH.exe 3332 AOKE.exe 3640 KHTMQH.exe 4800 SVYTB.exe 5312 OAQIRJ.exe 3480 CYQU.exe 868 ETHVM.exe 4508 YZOTJI.exe 5724 GMTIU.exe 1080 HPJWJP.exe 2112 PVWCTO.exe 3992 XIBRE.exe 3720 UBKT.exe 5828 EZQO.exe 4640 YUHP.exe 4120 GZUW.exe 960 SKEJCV.exe 3596 RVH.exe 1808 BTNUSKM.exe 2528 MLCEKLU.exe 1664 AJCQMW.exe 2296 IMTEAGG.exe 4584 QAFLLE.exe 3012 YQGKR.exe 3212 ADXMD.exe 4680 OJXX.exe 4260 WOK.exe 1540 VZNUYBZ.exe 2920 MHB.exe 2604 YKMN.exe 4376 PTAKG.exe 6012 CWLXPA.exe 2392 WRCZBUK.exe 3408 BREBNQ.exe 5800 MKTUWQ.exe 4900 WIZG.exe 3000 VTC.exe 1788 UDNMVTC.exe 3772 HOVLJ.exe 3636 GZYB.exe 1164 YCK.exe 2888 SURIOA.exe 748 HKSH.exe 4600 ADHS.exe 4588 ITIJLKX.exe 5160 BMYUVL.exe 2480 LJDPC.exe 6068 CSSUP.exe 5804 MSUZAIL.exe 5948 BIVQZ.exe 5132 OTD.exe 4528 NDGFWMR.exe 4244 VRTMGTN.exe 2516 IUBKUW.exe 2460 YKC.exe 624 YNOFHHG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FPQDQO.exe JPGBE.exe File opened for modification C:\windows\SysWOW64\SVYTB.exe KHTMQH.exe File created C:\windows\SysWOW64\HPJWJP.exe GMTIU.exe File created C:\windows\SysWOW64\YKMN.exe MHB.exe File opened for modification C:\windows\SysWOW64\RRYK.exe CBXLNBD.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe XKZQCTV.exe File opened for modification C:\windows\SysWOW64\KVLRR.exe HNK.exe File created C:\windows\SysWOW64\MLCEKLU.exe.bat BTNUSKM.exe File opened for modification C:\windows\SysWOW64\OJXX.exe ADXMD.exe File opened for modification C:\windows\SysWOW64\CSSUP.exe LJDPC.exe File created C:\windows\SysWOW64\CWOGS.exe.bat XTQLKBL.exe File created C:\windows\SysWOW64\RRYK.exe.bat CBXLNBD.exe File created C:\windows\SysWOW64\FPQDQO.exe.bat JPGBE.exe File created C:\windows\SysWOW64\AOKE.exe.bat IOVH.exe File created C:\windows\SysWOW64\SVYTB.exe KHTMQH.exe File opened for modification C:\windows\SysWOW64\YZOTJI.exe ETHVM.exe File created C:\windows\SysWOW64\MLCEKLU.exe BTNUSKM.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat WOK.exe File created C:\windows\SysWOW64\YKMN.exe.bat MHB.exe File opened for modification C:\windows\SysWOW64\MSUZAIL.exe CSSUP.exe File created C:\windows\SysWOW64\JPGBE.exe ZRO.exe File created C:\windows\SysWOW64\JPGBE.exe.bat ZRO.exe File created C:\windows\SysWOW64\CWLXPA.exe PTAKG.exe File created C:\windows\SysWOW64\HOVLJ.exe.bat UDNMVTC.exe File opened for modification C:\windows\SysWOW64\HKSH.exe SURIOA.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe XTQLKBL.exe File created C:\windows\SysWOW64\KVLRR.exe.bat HNK.exe File created C:\windows\SysWOW64\AOKE.exe IOVH.exe File created C:\windows\SysWOW64\YZOTJI.exe ETHVM.exe File created C:\windows\SysWOW64\AJCQMW.exe.bat MLCEKLU.exe File created C:\windows\SysWOW64\OJXX.exe.bat ADXMD.exe File created C:\windows\SysWOW64\VZNUYBZ.exe WOK.exe File created C:\windows\SysWOW64\BREBNQ.exe.bat WRCZBUK.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe UDNMVTC.exe File created C:\windows\SysWOW64\IOVH.exe.bat KVLRR.exe File opened for modification C:\windows\SysWOW64\HPJWJP.exe GMTIU.exe File created C:\windows\SysWOW64\AJCQMW.exe MLCEKLU.exe File created C:\windows\SysWOW64\CWLXPA.exe.bat PTAKG.exe File created C:\windows\SysWOW64\MKTUWQ.exe BREBNQ.exe File created C:\windows\SysWOW64\VTC.exe WIZG.exe File opened for modification C:\windows\SysWOW64\VTC.exe WIZG.exe File created C:\windows\SysWOW64\YCK.exe GZYB.exe File created C:\windows\SysWOW64\KVLRR.exe HNK.exe File created C:\windows\SysWOW64\YZOTJI.exe.bat ETHVM.exe File created C:\windows\SysWOW64\BREBNQ.exe WRCZBUK.exe File opened for modification C:\windows\SysWOW64\WIZG.exe MKTUWQ.exe File created C:\windows\SysWOW64\WIZG.exe.bat MKTUWQ.exe File created C:\windows\SysWOW64\HKSH.exe SURIOA.exe File created C:\windows\SysWOW64\CSSUP.exe LJDPC.exe File created C:\windows\SysWOW64\MSUZAIL.exe CSSUP.exe File created C:\windows\SysWOW64\GMTIU.exe YZOTJI.exe File created C:\windows\SysWOW64\IMTEAGG.exe.bat AJCQMW.exe File created C:\windows\SysWOW64\OJXX.exe ADXMD.exe File created C:\windows\SysWOW64\YCK.exe.bat GZYB.exe File created C:\windows\SysWOW64\HKSH.exe.bat SURIOA.exe File created C:\windows\SysWOW64\PCAALUK.exe.bat XHWWG.exe File created C:\windows\SysWOW64\RRYK.exe CBXLNBD.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe FBPB.exe File opened for modification C:\windows\SysWOW64\IOVH.exe KVLRR.exe File opened for modification C:\windows\SysWOW64\AJCQMW.exe MLCEKLU.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat FBPB.exe File created C:\windows\SysWOW64\PBEYF.exe.bat UTVJ.exe File created C:\windows\SysWOW64\SVYTB.exe.bat KHTMQH.exe File opened for modification C:\windows\SysWOW64\VZNUYBZ.exe WOK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\GZYB.exe HOVLJ.exe File opened for modification C:\windows\BIVQZ.exe MSUZAIL.exe File created C:\windows\XTQLKBL.exe.bat ZVW.exe File opened for modification C:\windows\system\BTNUSKM.exe RVH.exe File opened for modification C:\windows\QAFLLE.exe IMTEAGG.exe File opened for modification C:\windows\system\PVWCTO.exe HPJWJP.exe File created C:\windows\ADXMD.exe YQGKR.exe File created C:\windows\ITIJLKX.exe.bat ADHS.exe File created C:\windows\BMYUVL.exe ITIJLKX.exe File created C:\windows\ALUA.exe.bat YNOFHHG.exe File created C:\windows\system\MKNQ.exe.bat EWN.exe File created C:\windows\RNNSX.exe.bat 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe File created C:\windows\system\GZUW.exe YUHP.exe File opened for modification C:\windows\system\WOK.exe OJXX.exe File created C:\windows\BMYUVL.exe.bat ITIJLKX.exe File created C:\windows\system\FBPB.exe.bat RRYK.exe File created C:\windows\KHTMQH.exe.bat AOKE.exe File created C:\windows\system\UBKT.exe XIBRE.exe File created C:\windows\system\UBKT.exe.bat XIBRE.exe File created C:\windows\system\SKEJCV.exe.bat GZUW.exe File opened for modification C:\windows\system\WRCZBUK.exe CWLXPA.exe File opened for modification C:\windows\ZVW.exe ALUA.exe File created C:\windows\RVH.exe SKEJCV.exe File opened for modification C:\windows\PTAKG.exe YKMN.exe File created C:\windows\system\UDNMVTC.exe.bat VTC.exe File opened for modification C:\windows\BMYUVL.exe ITIJLKX.exe File created C:\windows\system\CYQU.exe OAQIRJ.exe File created C:\windows\EZQO.exe UBKT.exe File opened for modification C:\windows\RVH.exe SKEJCV.exe File created C:\windows\system\WOK.exe OJXX.exe File created C:\windows\BIVQZ.exe.bat MSUZAIL.exe File created C:\windows\system\RXAPXQ.exe JJVJNS.exe File opened for modification C:\windows\system\ETHVM.exe CYQU.exe File created C:\windows\system\BTNUSKM.exe.bat RVH.exe File created C:\windows\ADXMD.exe.bat YQGKR.exe File opened for modification C:\windows\system\UDNMVTC.exe VTC.exe File created C:\windows\system\ADHS.exe.bat HKSH.exe File created C:\windows\BIVQZ.exe MSUZAIL.exe File created C:\windows\system\UTVJ.exe.bat TQRFSXP.exe File created C:\windows\system\MKNQ.exe EWN.exe File created C:\windows\system\ETHVM.exe.bat CYQU.exe File created C:\windows\PTAKG.exe YKMN.exe File created C:\windows\SURIOA.exe.bat YCK.exe File opened for modification C:\windows\system\ZRO.exe WJFSGWY.exe File created C:\windows\system\ADHS.exe HKSH.exe File created C:\windows\VRTMGTN.exe NDGFWMR.exe File opened for modification C:\windows\RNNSX.exe 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe File opened for modification C:\windows\system\YQGKR.exe QAFLLE.exe File created C:\windows\NDGFWMR.exe.bat OTD.exe File created C:\windows\system\YKC.exe IUBKUW.exe File created C:\windows\system\ZRO.exe WJFSGWY.exe File created C:\windows\OAQIRJ.exe.bat SVYTB.exe File created C:\windows\system\PVWCTO.exe HPJWJP.exe File opened for modification C:\windows\ITIJLKX.exe ADHS.exe File opened for modification C:\windows\OTD.exe BIVQZ.exe File opened for modification C:\windows\VRTMGTN.exe NDGFWMR.exe File opened for modification C:\windows\IUBKUW.exe VRTMGTN.exe File created C:\windows\system\RXAPXQ.exe.bat JJVJNS.exe File opened for modification C:\windows\system\CYQU.exe OAQIRJ.exe File created C:\windows\YUHP.exe.bat EZQO.exe File opened for modification C:\windows\system\YNOFHHG.exe YKC.exe File created C:\windows\ZVW.exe ALUA.exe File created C:\windows\CBXLNBD.exe.bat LSVG.exe File created C:\windows\system\FBPB.exe RRYK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1584 cmd.exe 2600 cmd.exe 4592 cmd.exe 4976 cmd.exe 424 cmd.exe 796 cmd.exe 4444 cmd.exe 1376 cmd.exe 2672 cmd.exe 4784 cmd.exe 3812 cmd.exe 5052 cmd.exe 1472 cmd.exe 5288 cmd.exe 6072 cmd.exe 3252 cmd.exe 4192 cmd.exe 3368 cmd.exe 1152 cmd.exe 5296 cmd.exe 4624 cmd.exe 5660 cmd.exe 4468 cmd.exe 1480 cmd.exe 1448 cmd.exe 3696 cmd.exe 3256 cmd.exe 2340 cmd.exe 5472 cmd.exe 5728 cmd.exe 2264 cmd.exe 1412 cmd.exe 4300 cmd.exe 2352 cmd.exe 1668 cmd.exe 1076 cmd.exe 2176 cmd.exe 4780 cmd.exe 2456 cmd.exe 1568 cmd.exe 6040 cmd.exe 5912 cmd.exe 2772 cmd.exe 3816 cmd.exe 4804 cmd.exe 5108 cmd.exe 2572 cmd.exe 548 cmd.exe 3736 cmd.exe 4948 cmd.exe 4636 cmd.exe 3360 cmd.exe 4704 cmd.exe 3832 cmd.exe 5808 cmd.exe 1756 cmd.exe 824 cmd.exe 2676 cmd.exe 2660 cmd.exe 1428 cmd.exe 1260 cmd.exe 3792 cmd.exe 2036 cmd.exe 2612 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1376 2840 WerFault.exe 87 3392 5904 WerFault.exe 93 784 1192 WerFault.exe 99 4508 4816 WerFault.exe 104 748 5688 WerFault.exe 109 904 5880 WerFault.exe 114 3892 5952 WerFault.exe 119 3748 4844 WerFault.exe 124 824 1476 WerFault.exe 129 3768 1508 WerFault.exe 134 2480 3332 WerFault.exe 139 1716 3640 WerFault.exe 144 1540 4800 WerFault.exe 149 3708 5312 WerFault.exe 154 244 3480 WerFault.exe 159 2528 868 WerFault.exe 164 748 4508 WerFault.exe 169 2296 5724 WerFault.exe 174 3348 1080 WerFault.exe 179 6064 2112 WerFault.exe 184 3808 3992 WerFault.exe 189 668 3720 WerFault.exe 194 5092 5828 WerFault.exe 199 4256 4640 WerFault.exe 204 4696 4120 WerFault.exe 209 2676 960 WerFault.exe 214 3800 3596 WerFault.exe 219 5660 1808 WerFault.exe 224 1888 2528 WerFault.exe 229 4956 1664 WerFault.exe 234 2424 2296 WerFault.exe 239 2832 4584 WerFault.exe 244 1872 3012 WerFault.exe 249 2964 3212 WerFault.exe 254 1732 4680 WerFault.exe 259 5632 4260 WerFault.exe 264 120 1540 WerFault.exe 269 2328 2920 WerFault.exe 274 1296 2604 WerFault.exe 279 1532 4376 WerFault.exe 284 4320 6012 WerFault.exe 289 4284 2392 WerFault.exe 294 4588 3408 WerFault.exe 299 5576 5800 WerFault.exe 304 3464 4900 WerFault.exe 309 2772 3000 WerFault.exe 314 3268 1788 WerFault.exe 319 3084 3772 WerFault.exe 324 2116 3636 WerFault.exe 329 3520 1164 WerFault.exe 334 3312 2888 WerFault.exe 339 4212 748 WerFault.exe 344 5912 4600 WerFault.exe 349 3572 4588 WerFault.exe 354 2136 5160 WerFault.exe 359 1852 2480 WerFault.exe 364 4644 6068 WerFault.exe 369 3084 5804 WerFault.exe 374 2116 5948 WerFault.exe 379 1076 5132 WerFault.exe 384 3132 4528 WerFault.exe 389 5920 4244 WerFault.exe 394 5840 2516 WerFault.exe 399 4924 2460 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKTUWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQRFSXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVYTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAQIRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMTEAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADXMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTAKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJFSGWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BREBNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUZAIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EATTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVLRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHTMQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJVJNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBEYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAFLLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNOFHHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZOTJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLCEKLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe 2840 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe 5904 RNNSX.exe 5904 RNNSX.exe 1192 WJFSGWY.exe 1192 WJFSGWY.exe 4816 ZRO.exe 4816 ZRO.exe 5688 JPGBE.exe 5688 JPGBE.exe 5880 FPQDQO.exe 5880 FPQDQO.exe 5952 EATTQ.exe 5952 EATTQ.exe 4844 HNK.exe 4844 HNK.exe 1476 KVLRR.exe 1476 KVLRR.exe 1508 IOVH.exe 1508 IOVH.exe 3332 AOKE.exe 3332 AOKE.exe 3640 KHTMQH.exe 3640 KHTMQH.exe 4800 SVYTB.exe 4800 SVYTB.exe 5312 OAQIRJ.exe 5312 OAQIRJ.exe 3480 CYQU.exe 3480 CYQU.exe 868 ETHVM.exe 868 ETHVM.exe 4508 YZOTJI.exe 4508 YZOTJI.exe 5724 GMTIU.exe 5724 GMTIU.exe 1080 HPJWJP.exe 1080 HPJWJP.exe 2112 PVWCTO.exe 2112 PVWCTO.exe 3992 XIBRE.exe 3992 XIBRE.exe 3720 UBKT.exe 3720 UBKT.exe 5828 EZQO.exe 5828 EZQO.exe 4640 YUHP.exe 4640 YUHP.exe 4120 GZUW.exe 4120 GZUW.exe 960 SKEJCV.exe 960 SKEJCV.exe 3596 RVH.exe 3596 RVH.exe 1808 BTNUSKM.exe 1808 BTNUSKM.exe 2528 MLCEKLU.exe 2528 MLCEKLU.exe 1664 AJCQMW.exe 1664 AJCQMW.exe 2296 IMTEAGG.exe 2296 IMTEAGG.exe 4584 QAFLLE.exe 4584 QAFLLE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2840 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe 2840 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe 5904 RNNSX.exe 5904 RNNSX.exe 1192 WJFSGWY.exe 1192 WJFSGWY.exe 4816 ZRO.exe 4816 ZRO.exe 5688 JPGBE.exe 5688 JPGBE.exe 5880 FPQDQO.exe 5880 FPQDQO.exe 5952 EATTQ.exe 5952 EATTQ.exe 4844 HNK.exe 4844 HNK.exe 1476 KVLRR.exe 1476 KVLRR.exe 1508 IOVH.exe 1508 IOVH.exe 3332 AOKE.exe 3332 AOKE.exe 3640 KHTMQH.exe 3640 KHTMQH.exe 4800 SVYTB.exe 4800 SVYTB.exe 5312 OAQIRJ.exe 5312 OAQIRJ.exe 3480 CYQU.exe 3480 CYQU.exe 868 ETHVM.exe 868 ETHVM.exe 4508 YZOTJI.exe 4508 YZOTJI.exe 5724 GMTIU.exe 5724 GMTIU.exe 1080 HPJWJP.exe 1080 HPJWJP.exe 2112 PVWCTO.exe 2112 PVWCTO.exe 3992 XIBRE.exe 3992 XIBRE.exe 3720 UBKT.exe 3720 UBKT.exe 5828 EZQO.exe 5828 EZQO.exe 4640 YUHP.exe 4640 YUHP.exe 4120 GZUW.exe 4120 GZUW.exe 960 SKEJCV.exe 960 SKEJCV.exe 3596 RVH.exe 3596 RVH.exe 1808 BTNUSKM.exe 1808 BTNUSKM.exe 2528 MLCEKLU.exe 2528 MLCEKLU.exe 1664 AJCQMW.exe 1664 AJCQMW.exe 2296 IMTEAGG.exe 2296 IMTEAGG.exe 4584 QAFLLE.exe 4584 QAFLLE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 3384 2840 2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe 89 PID 3384 wrote to memory of 5904 3384 cmd.exe 93 PID 5904 wrote to memory of 5532 5904 RNNSX.exe 95 PID 5532 wrote to memory of 1192 5532 cmd.exe 99 PID 1192 wrote to memory of 1756 1192 WJFSGWY.exe 100 PID 1756 wrote to memory of 4816 1756 cmd.exe 104 PID 4816 wrote to memory of 2704 4816 ZRO.exe 105 PID 2704 wrote to memory of 5688 2704 cmd.exe 109 PID 5688 wrote to memory of 1536 5688 JPGBE.exe 110 PID 1536 wrote to memory of 5880 1536 cmd.exe 114 PID 5880 wrote to memory of 1976 5880 FPQDQO.exe 115 PID 1976 wrote to memory of 5952 1976 cmd.exe 119 PID 5952 wrote to memory of 2456 5952 EATTQ.exe 120 PID 2456 wrote to memory of 4844 2456 cmd.exe 124 PID 4844 wrote to memory of 796 4844 HNK.exe 125 PID 796 wrote to memory of 1476 796 cmd.exe 129 PID 1476 wrote to memory of 940 1476 KVLRR.exe 130 PID 940 wrote to memory of 1508 940 cmd.exe 134 PID 1508 wrote to memory of 1244 1508 IOVH.exe 135 PID 1244 wrote to memory of 3332 1244 cmd.exe 139 PID 3332 wrote to memory of 2560 3332 AOKE.exe 140 PID 2560 wrote to memory of 3640 2560 cmd.exe 144 PID 3640 wrote to memory of 5256 3640 KHTMQH.exe 145 PID 5256 wrote to memory of 4800 5256 cmd.exe 149 PID 4800 wrote to memory of 4596 4800 SVYTB.exe 150 PID 4596 wrote to memory of 5312 4596 cmd.exe 154 PID 5312 wrote to memory of 4220 5312 OAQIRJ.exe 155 PID 4220 wrote to memory of 3480 4220 cmd.exe 159 PID 3480 wrote to memory of 2108 3480 CYQU.exe 160 PID 2108 wrote to memory of 868 2108 cmd.exe 164 PID 868 wrote to memory of 4548 868 ETHVM.exe 165 PID 4548 wrote to memory of 4508 4548 cmd.exe 169 PID 4508 wrote to memory of 4372 4508 YZOTJI.exe 170 PID 4372 wrote to memory of 5724 4372 cmd.exe 174 PID 5724 wrote to memory of 4636 5724 GMTIU.exe 175 PID 4636 wrote to memory of 1080 4636 cmd.exe 179 PID 1080 wrote to memory of 2572 1080 HPJWJP.exe 180 PID 2572 wrote to memory of 2112 2572 cmd.exe 184 PID 2112 wrote to memory of 5100 2112 PVWCTO.exe 185 PID 5100 wrote to memory of 3992 5100 cmd.exe 189 PID 3992 wrote to memory of 2352 3992 XIBRE.exe 190 PID 2352 wrote to memory of 3720 2352 cmd.exe 194 PID 3720 wrote to memory of 548 3720 UBKT.exe 195 PID 548 wrote to memory of 5828 548 cmd.exe 199 PID 5828 wrote to memory of 4988 5828 EZQO.exe 200 PID 4988 wrote to memory of 4640 4988 cmd.exe 204 PID 4640 wrote to memory of 4796 4640 YUHP.exe 205 PID 4796 wrote to memory of 4120 4796 cmd.exe 209 PID 4120 wrote to memory of 6072 4120 GZUW.exe 210 PID 6072 wrote to memory of 960 6072 cmd.exe 214 PID 960 wrote to memory of 4736 960 SKEJCV.exe 215 PID 4736 wrote to memory of 3596 4736 cmd.exe 219 PID 3596 wrote to memory of 5836 3596 RVH.exe 220 PID 5836 wrote to memory of 1808 5836 cmd.exe 224 PID 1808 wrote to memory of 1568 1808 BTNUSKM.exe 225 PID 1568 wrote to memory of 2528 1568 cmd.exe 229 PID 2528 wrote to memory of 4976 2528 MLCEKLU.exe 230 PID 4976 wrote to memory of 1664 4976 cmd.exe 234 PID 1664 wrote to memory of 3716 1664 AJCQMW.exe 235 PID 3716 wrote to memory of 2296 3716 cmd.exe 239 PID 2296 wrote to memory of 1504 2296 IMTEAGG.exe 240 PID 1504 wrote to memory of 4584 1504 cmd.exe 244 PID 4584 wrote to memory of 824 4584 QAFLLE.exe 245 PID 824 wrote to memory of 3012 824 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_bc4c2f7b3b6ddb2cc794cf314cb91f94_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RNNSX.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\RNNSX.exeC:\windows\RNNSX.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJFSGWY.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\WJFSGWY.exeC:\windows\WJFSGWY.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\system\ZRO.exeC:\windows\system\ZRO.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPGBE.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\SysWOW64\JPGBE.exeC:\windows\system32\JPGBE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPQDQO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\SysWOW64\FPQDQO.exeC:\windows\system32\FPQDQO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EATTQ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\EATTQ.exeC:\windows\EATTQ.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNK.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\HNK.exeC:\windows\HNK.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVLRR.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\SysWOW64\KVLRR.exeC:\windows\system32\KVLRR.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IOVH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\SysWOW64\IOVH.exeC:\windows\system32\IOVH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOKE.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\SysWOW64\AOKE.exeC:\windows\system32\AOKE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHTMQH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\KHTMQH.exeC:\windows\KHTMQH.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYQU.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\system\CYQU.exeC:\windows\system\CYQU.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETHVM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\system\ETHVM.exeC:\windows\system\ETHVM.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YZOTJI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\YZOTJI.exeC:\windows\system32\YZOTJI.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMTIU.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\GMTIU.exeC:\windows\system32\GMTIU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPJWJP.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\SysWOW64\HPJWJP.exeC:\windows\system32\HPJWJP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVWCTO.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\PVWCTO.exeC:\windows\system\PVWCTO.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIBRE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\system\XIBRE.exeC:\windows\system\XIBRE.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZQO.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\EZQO.exeC:\windows\EZQO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\YUHP.exeC:\windows\YUHP.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZUW.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\system\GZUW.exeC:\windows\system\GZUW.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKEJCV.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\system\SKEJCV.exeC:\windows\system\SKEJCV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVH.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\RVH.exeC:\windows\RVH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLCEKLU.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\SysWOW64\MLCEKLU.exeC:\windows\system32\MLCEKLU.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJCQMW.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\SysWOW64\AJCQMW.exeC:\windows\system32\AJCQMW.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTEAGG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\SysWOW64\IMTEAGG.exeC:\windows\system32\IMTEAGG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAFLLE.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\windows\QAFLLE.exeC:\windows\QAFLLE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQGKR.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\system\YQGKR.exeC:\windows\system\YQGKR.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADXMD.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4444 -
C:\windows\ADXMD.exeC:\windows\ADXMD.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJXX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\windows\SysWOW64\OJXX.exeC:\windows\system32\OJXX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "70⤵PID:2368
-
C:\windows\system\WOK.exeC:\windows\system\WOK.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1376 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe73⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3708 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "76⤵PID:6032
-
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTAKG.exe.bat" "78⤵PID:6004
-
C:\windows\PTAKG.exeC:\windows\PTAKG.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWLXPA.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4448 -
C:\windows\SysWOW64\CWLXPA.exeC:\windows\system32\CWLXPA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BREBNQ.exe.bat" "84⤵PID:5860
-
C:\windows\SysWOW64\BREBNQ.exeC:\windows\system32\BREBNQ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3252 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6040 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4192 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOVLJ.exe.bat" "94⤵PID:4724
-
C:\windows\SysWOW64\HOVLJ.exeC:\windows\system32\HOVLJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "96⤵PID:4532
-
C:\windows\GZYB.exeC:\windows\GZYB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCK.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3360 -
C:\windows\SysWOW64\YCK.exeC:\windows\system32\YCK.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5660 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "102⤵PID:468
-
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "104⤵PID:3500
-
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "106⤵PID:2832
-
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe109⤵
- Executes dropped EXE
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJDPC.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\windows\SysWOW64\LJDPC.exeC:\windows\system32\LJDPC.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSSUP.exe.bat" "112⤵PID:296
-
C:\windows\SysWOW64\CSSUP.exeC:\windows\system32\CSSUP.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "114⤵PID:2384
-
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2676 -
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1472 -
C:\windows\OTD.exeC:\windows\OTD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-