Analysis
- max time kernel
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe
- Size 208KB
- Sample260813-vbxgescn4v
- SHA256 640e8e86a1534b19c694c0565009bf08dd64ddd6db498983e38891827218d04f
- MD5 393bd6632693e606f3ad523ebe632bff
- SHA1 a278b0a43f5ca84056a6761a2df5daec39e127c0
- SHA512 125e9cda97f3cf812b4f22266727d5a3d41572884a47dff1f67dbffed9f1cc82dd395687332b027f8c61c8e3985f8e4076694f6b01981aa8eaf56e5a1b055ea2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfu4NLthEjQT6:MlZtbLWIgd1LZ9oECZbclc5+LOmQEj
- TLSH T19F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4972 LXL.exe 5828 JBKXB.exe 3700 DOE.exe 3496 UOS.exe 3448 NPA.exe 716 MAKTUNC.exe 1260 DIRRGEF.exe 3204 FYELON.exe 5052 BDEXP.exe 5284 VRWYJJ.exe 1244 TPJQRR.exe 1468 GMJC.exe 4332 QKXW.exe 5764 NLY.exe 5456 ELN.exe 4488 XORZMVS.exe 5204 OWFWYMN.exe 5756 KZOVF.exe 3188 SNACP.exe 4160 JIGUYF.exe 3328 WTPTMQ.exe 5516 QLEE.exe 2416 XBFVCFN.exe 6072 QUMGLFV.exe 4900 ARAABOE.exe 1036 OXAMD.exe 352 HQP.exe 4288 JNV.exe 928 IYYHCPT.exe 5720 BRNSTQB.exe 3288 JESZEO.exe 5188 YUB.exe 5476 PFEGLQH.exe 1456 KQMFA.exe 3472 AGN.exe 972 WDFU.exe 1828 CZFU.exe 1096 KMJB.exe 4528 WFZM.exe 4776 ZNHJC.exe 4536 ZQYXRP.exe 4756 FLJYXE.exe 2352 KMLAIIK.exe 5608 FZC.exe 3956 IHLYBNV.exe 6048 MNVNRJQ.exe 4684 DYGDAX.exe 2856 IYIGE.exe 4352 CLZPXM.exe 2840 KZMWAK.exe 4180 SEQDK.exe 2480 OKYO.exe 4764 BNHFIXY.exe 2816 EDQ.exe 1740 YRZD.exe 2476 SEGJGMG.exe 3480 LXVUPNO.exe 4300 CFCRCWJ.exe 3848 JANS.exe 1600 WYN.exe 4616 ZTF.exe 1404 HZR.exe 3364 DZTOZSU.exe 3736 GMK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\LXL.exe 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LXL.exe 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\DOE.exe JBKXB.exe File opened for modification C:\windows\SysWOW64\GMJC.exe TPJQRR.exe File created C:\windows\SysWOW64\EDQ.exe.bat BNHFIXY.exe File created C:\windows\SysWOW64\LXL.exe.bat 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe File created C:\windows\SysWOW64\GMJC.exe.bat TPJQRR.exe File created C:\windows\SysWOW64\QKXW.exe GMJC.exe File opened for modification C:\windows\SysWOW64\YUB.exe JESZEO.exe File created C:\windows\SysWOW64\YUB.exe.bat JESZEO.exe File opened for modification C:\windows\SysWOW64\SEQDK.exe KZMWAK.exe File created C:\windows\SysWOW64\LXVUPNO.exe SEGJGMG.exe File created C:\windows\SysWOW64\JNV.exe.bat HQP.exe File created C:\windows\SysWOW64\JESZEO.exe.bat BRNSTQB.exe File created C:\windows\SysWOW64\ZNHJC.exe.bat WFZM.exe File created C:\windows\SysWOW64\EDQ.exe BNHFIXY.exe File opened for modification C:\windows\SysWOW64\EDQ.exe BNHFIXY.exe File created C:\windows\SysWOW64\MAKTUNC.exe.bat NPA.exe File created C:\windows\SysWOW64\DIRRGEF.exe.bat MAKTUNC.exe File created C:\windows\SysWOW64\GMJC.exe TPJQRR.exe File created C:\windows\SysWOW64\JNV.exe HQP.exe File opened for modification C:\windows\SysWOW64\IHLYBNV.exe FZC.exe File created C:\windows\SysWOW64\MAKTUNC.exe NPA.exe File created C:\windows\SysWOW64\BDEXP.exe.bat FYELON.exe File created C:\windows\SysWOW64\JIGUYF.exe SNACP.exe File opened for modification C:\windows\SysWOW64\KQMFA.exe PFEGLQH.exe File created C:\windows\SysWOW64\KZOVF.exe.bat OWFWYMN.exe File created C:\windows\SysWOW64\KMLAIIK.exe.bat FLJYXE.exe File created C:\windows\SysWOW64\KZMWAK.exe CLZPXM.exe File created C:\windows\SysWOW64\WYN.exe JANS.exe File created C:\windows\SysWOW64\BDEXP.exe FYELON.exe File opened for modification C:\windows\SysWOW64\ARAABOE.exe QUMGLFV.exe File opened for modification C:\windows\SysWOW64\KZMWAK.exe CLZPXM.exe File opened for modification C:\windows\SysWOW64\WYN.exe JANS.exe File created C:\windows\SysWOW64\DIRRGEF.exe MAKTUNC.exe File opened for modification C:\windows\SysWOW64\DIRRGEF.exe MAKTUNC.exe File created C:\windows\SysWOW64\ARAABOE.exe QUMGLFV.exe File created C:\windows\SysWOW64\OKYO.exe SEQDK.exe File created C:\windows\SysWOW64\CFCRCWJ.exe.bat LXVUPNO.exe File created C:\windows\SysWOW64\DOE.exe JBKXB.exe File opened for modification C:\windows\SysWOW64\MAKTUNC.exe NPA.exe File created C:\windows\SysWOW64\JESZEO.exe BRNSTQB.exe File created C:\windows\SysWOW64\YUB.exe JESZEO.exe File opened for modification C:\windows\SysWOW64\KMLAIIK.exe FLJYXE.exe File created C:\windows\SysWOW64\IHLYBNV.exe FZC.exe File opened for modification C:\windows\SysWOW64\LXVUPNO.exe SEGJGMG.exe File opened for modification C:\windows\SysWOW64\JIGUYF.exe SNACP.exe File created C:\windows\SysWOW64\KQMFA.exe.bat PFEGLQH.exe File created C:\windows\SysWOW64\DOE.exe.bat JBKXB.exe File created C:\windows\SysWOW64\QKXW.exe.bat GMJC.exe File opened for modification C:\windows\SysWOW64\FLJYXE.exe ZQYXRP.exe File created C:\windows\SysWOW64\SEQDK.exe KZMWAK.exe File opened for modification C:\windows\SysWOW64\OKYO.exe SEQDK.exe File created C:\windows\SysWOW64\OKYO.exe.bat SEQDK.exe File created C:\windows\SysWOW64\LXVUPNO.exe.bat SEGJGMG.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe LXVUPNO.exe File opened for modification C:\windows\SysWOW64\JESZEO.exe BRNSTQB.exe File created C:\windows\SysWOW64\KMLAIIK.exe FLJYXE.exe File opened for modification C:\windows\SysWOW64\BDEXP.exe FYELON.exe File created C:\windows\SysWOW64\KQMFA.exe PFEGLQH.exe File created C:\windows\SysWOW64\CFCRCWJ.exe LXVUPNO.exe File created C:\windows\SysWOW64\JIGUYF.exe.bat SNACP.exe File opened for modification C:\windows\SysWOW64\JNV.exe HQP.exe File created C:\windows\SysWOW64\SEQDK.exe.bat KZMWAK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\OXAMD.exe.bat ARAABOE.exe File created C:\windows\DYGDAX.exe.bat MNVNRJQ.exe File created C:\windows\DZTOZSU.exe.bat HZR.exe File opened for modification C:\windows\system\UOS.exe DOE.exe File created C:\windows\PFEGLQH.exe.bat YUB.exe File opened for modification C:\windows\BNHFIXY.exe OKYO.exe File opened for modification C:\windows\system\JBKXB.exe LXL.exe File created C:\windows\system\AGN.exe KQMFA.exe File created C:\windows\system\SEGJGMG.exe.bat YRZD.exe File created C:\windows\system\VRWYJJ.exe.bat BDEXP.exe File created C:\windows\XORZMVS.exe ELN.exe File created C:\windows\DYGDAX.exe MNVNRJQ.exe File created C:\windows\BNHFIXY.exe.bat OKYO.exe File created C:\windows\JANS.exe CFCRCWJ.exe File opened for modification C:\windows\system\WEYBMG.exe WQY.exe File created C:\windows\HQP.exe OXAMD.exe File created C:\windows\system\MNVNRJQ.exe IHLYBNV.exe File created C:\windows\IYIGE.exe DYGDAX.exe File created C:\windows\JANS.exe.bat CFCRCWJ.exe File created C:\windows\system\GMK.exe DZTOZSU.exe File created C:\windows\system\WEYBMG.exe.bat WQY.exe File opened for modification C:\windows\CZFU.exe WDFU.exe File created C:\windows\NLY.exe.bat QKXW.exe File opened for modification C:\windows\SNACP.exe KZOVF.exe File created C:\windows\system\AGN.exe.bat KQMFA.exe File created C:\windows\CZFU.exe WDFU.exe File created C:\windows\KMJB.exe CZFU.exe File created C:\windows\system\MNVNRJQ.exe.bat IHLYBNV.exe File created C:\windows\system\FYELON.exe DIRRGEF.exe File created C:\windows\WTPTMQ.exe JIGUYF.exe File opened for modification C:\windows\WTPTMQ.exe JIGUYF.exe File created C:\windows\XBFVCFN.exe.bat QLEE.exe File created C:\windows\IYYHCPT.exe.bat JNV.exe File created C:\windows\CZFU.exe.bat WDFU.exe File created C:\windows\FZC.exe.bat KMLAIIK.exe File opened for modification C:\windows\DYGDAX.exe MNVNRJQ.exe File created C:\windows\system\JBKXB.exe LXL.exe File opened for modification C:\windows\IYYHCPT.exe JNV.exe File created C:\windows\PFEGLQH.exe YUB.exe File created C:\windows\system\WFZM.exe KMJB.exe File opened for modification C:\windows\system\TPJQRR.exe VRWYJJ.exe File created C:\windows\system\QUMGLFV.exe XBFVCFN.exe File opened for modification C:\windows\PFEGLQH.exe YUB.exe File created C:\windows\system\GMK.exe.bat DZTOZSU.exe File opened for modification C:\windows\YRZD.exe EDQ.exe File created C:\windows\ZTF.exe WYN.exe File created C:\windows\system\NPA.exe.bat UOS.exe File opened for modification C:\windows\system\OWFWYMN.exe XORZMVS.exe File created C:\windows\WTPTMQ.exe.bat JIGUYF.exe File opened for modification C:\windows\HQP.exe OXAMD.exe File opened for modification C:\windows\WDFU.exe AGN.exe File created C:\windows\YRZD.exe.bat EDQ.exe File created C:\windows\system\QQQ.exe.bat FXVOTSY.exe File created C:\windows\XORZMVS.exe.bat ELN.exe File created C:\windows\system\ELN.exe.bat NLY.exe File opened for modification C:\windows\system\MNVNRJQ.exe IHLYBNV.exe File created C:\windows\system\CLZPXM.exe IYIGE.exe File created C:\windows\HZR.exe.bat ZTF.exe File created C:\windows\system\FXVOTSY.exe GMK.exe File opened for modification C:\windows\system\FXVOTSY.exe GMK.exe File created C:\windows\ZTF.exe.bat WYN.exe File created C:\windows\DZTOZSU.exe HZR.exe File created C:\windows\system\WEYBMG.exe WQY.exe File created C:\windows\system\UOS.exe DOE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5896 cmd.exe 4108 cmd.exe 568 cmd.exe 1808 cmd.exe 4240 cmd.exe 1324 cmd.exe 2852 cmd.exe 3080 cmd.exe 5620 cmd.exe 260 cmd.exe 4416 cmd.exe 3908 cmd.exe 3312 cmd.exe 5152 cmd.exe 4888 cmd.exe 3712 cmd.exe 4668 cmd.exe 3232 cmd.exe 5436 cmd.exe 4408 cmd.exe 4520 cmd.exe 3820 cmd.exe 5448 cmd.exe 1160 cmd.exe 4836 cmd.exe 1204 cmd.exe 4904 cmd.exe 2020 cmd.exe 5164 cmd.exe 3952 cmd.exe 3548 cmd.exe 4420 cmd.exe 1780 cmd.exe 912 cmd.exe 4592 cmd.exe 5136 cmd.exe 2512 cmd.exe 4224 cmd.exe 1240 cmd.exe 5376 cmd.exe 2768 cmd.exe 2432 cmd.exe 1956 cmd.exe 5344 cmd.exe 1168 cmd.exe 4676 cmd.exe 2716 cmd.exe 1188 cmd.exe 520 cmd.exe 1824 cmd.exe 3004 cmd.exe 2580 cmd.exe 5612 cmd.exe 4140 cmd.exe 2464 cmd.exe 564 cmd.exe 5008 cmd.exe 4376 cmd.exe 5264 cmd.exe 2128 cmd.exe 5760 cmd.exe 3532 cmd.exe 3212 cmd.exe 4876 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5096 6012 WerFault.exe 87 4544 4972 WerFault.exe 93 2032 5828 WerFault.exe 99 1184 3700 WerFault.exe 104 4288 3496 WerFault.exe 109 3240 3448 WerFault.exe 114 988 716 WerFault.exe 119 3288 1260 WerFault.exe 124 3080 3204 WerFault.exe 129 5428 5052 WerFault.exe 134 2068 5284 WerFault.exe 139 1836 1244 WerFault.exe 144 5844 1468 WerFault.exe 149 5816 4332 WerFault.exe 154 384 5764 WerFault.exe 159 1428 5456 WerFault.exe 164 2672 4488 WerFault.exe 169 3916 5204 WerFault.exe 174 1268 5756 WerFault.exe 179 2444 3188 WerFault.exe 184 1276 4160 WerFault.exe 189 4564 3328 WerFault.exe 194 4996 5516 WerFault.exe 199 3952 2416 WerFault.exe 204 2856 6072 WerFault.exe 209 5464 4900 WerFault.exe 214 1096 1036 WerFault.exe 219 968 352 WerFault.exe 224 3272 4288 WerFault.exe 229 1344 928 WerFault.exe 234 896 5720 WerFault.exe 239 868 3288 WerFault.exe 244 5448 5188 WerFault.exe 249 5264 5476 WerFault.exe 254 2948 1456 WerFault.exe 259 1160 3472 WerFault.exe 264 2032 972 WerFault.exe 269 3804 1828 WerFault.exe 274 808 1096 WerFault.exe 279 4116 4528 WerFault.exe 284 4224 4776 WerFault.exe 288 3168 4536 WerFault.exe 294 5084 4756 WerFault.exe 299 1824 2352 WerFault.exe 304 5396 5608 WerFault.exe 309 2848 3956 WerFault.exe 314 3656 6048 WerFault.exe 318 5888 4684 WerFault.exe 324 2992 2856 WerFault.exe 329 1868 4352 WerFault.exe 334 1588 2840 WerFault.exe 339 3836 4180 WerFault.exe 344 5472 2480 WerFault.exe 349 6044 4764 WerFault.exe 354 1136 2816 WerFault.exe 359 4196 1740 WerFault.exe 364 1584 2476 WerFault.exe 369 4500 3480 WerFault.exe 374 568 4300 WerFault.exe 379 4240 3848 WerFault.exe 384 2404 1600 WerFault.exe 389 4344 4616 WerFault.exe 393 4788 1404 WerFault.exe 399 3312 3364 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTPTMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUMGLFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAKTUNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRNSTQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JESZEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWFWYMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHLYBNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEQDK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMLAIIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEGJGMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZTOZSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLZPXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVOTSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYELON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIGUYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXAMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQYXRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLJYXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNVNRJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNHFIXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKYO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6012 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe 6012 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe 4972 LXL.exe 4972 LXL.exe 5828 JBKXB.exe 5828 JBKXB.exe 3700 DOE.exe 3700 DOE.exe 3496 UOS.exe 3496 UOS.exe 3448 NPA.exe 3448 NPA.exe 716 MAKTUNC.exe 716 MAKTUNC.exe 1260 DIRRGEF.exe 1260 DIRRGEF.exe 3204 FYELON.exe 3204 FYELON.exe 5052 BDEXP.exe 5052 BDEXP.exe 5284 VRWYJJ.exe 5284 VRWYJJ.exe 1244 TPJQRR.exe 1244 TPJQRR.exe 1468 GMJC.exe 1468 GMJC.exe 4332 QKXW.exe 4332 QKXW.exe 5764 NLY.exe 5764 NLY.exe 5456 ELN.exe 5456 ELN.exe 4488 XORZMVS.exe 4488 XORZMVS.exe 5204 OWFWYMN.exe 5204 OWFWYMN.exe 5756 KZOVF.exe 5756 KZOVF.exe 3188 SNACP.exe 3188 SNACP.exe 4160 JIGUYF.exe 4160 JIGUYF.exe 3328 WTPTMQ.exe 3328 WTPTMQ.exe 5516 QLEE.exe 5516 QLEE.exe 2416 XBFVCFN.exe 2416 XBFVCFN.exe 6072 QUMGLFV.exe 6072 QUMGLFV.exe 4900 ARAABOE.exe 4900 ARAABOE.exe 1036 OXAMD.exe 1036 OXAMD.exe 352 HQP.exe 352 HQP.exe 4288 JNV.exe 4288 JNV.exe 928 IYYHCPT.exe 928 IYYHCPT.exe 5720 BRNSTQB.exe 5720 BRNSTQB.exe 3288 JESZEO.exe 3288 JESZEO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6012 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe 6012 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe 4972 LXL.exe 4972 LXL.exe 5828 JBKXB.exe 5828 JBKXB.exe 3700 DOE.exe 3700 DOE.exe 3496 UOS.exe 3496 UOS.exe 3448 NPA.exe 3448 NPA.exe 716 MAKTUNC.exe 716 MAKTUNC.exe 1260 DIRRGEF.exe 1260 DIRRGEF.exe 3204 FYELON.exe 3204 FYELON.exe 5052 BDEXP.exe 5052 BDEXP.exe 5284 VRWYJJ.exe 5284 VRWYJJ.exe 1244 TPJQRR.exe 1244 TPJQRR.exe 1468 GMJC.exe 1468 GMJC.exe 4332 QKXW.exe 4332 QKXW.exe 5764 NLY.exe 5764 NLY.exe 5456 ELN.exe 5456 ELN.exe 4488 XORZMVS.exe 4488 XORZMVS.exe 5204 OWFWYMN.exe 5204 OWFWYMN.exe 5756 KZOVF.exe 5756 KZOVF.exe 3188 SNACP.exe 3188 SNACP.exe 4160 JIGUYF.exe 4160 JIGUYF.exe 3328 WTPTMQ.exe 3328 WTPTMQ.exe 5516 QLEE.exe 5516 QLEE.exe 2416 XBFVCFN.exe 2416 XBFVCFN.exe 6072 QUMGLFV.exe 6072 QUMGLFV.exe 4900 ARAABOE.exe 4900 ARAABOE.exe 1036 OXAMD.exe 1036 OXAMD.exe 352 HQP.exe 352 HQP.exe 4288 JNV.exe 4288 JNV.exe 928 IYYHCPT.exe 928 IYYHCPT.exe 5720 BRNSTQB.exe 5720 BRNSTQB.exe 3288 JESZEO.exe 3288 JESZEO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6012 wrote to memory of 4168 6012 2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe 89 PID 4168 wrote to memory of 4972 4168 cmd.exe 93 PID 4972 wrote to memory of 3588 4972 LXL.exe 95 PID 3588 wrote to memory of 5828 3588 cmd.exe 99 PID 5828 wrote to memory of 1980 5828 JBKXB.exe 100 PID 1980 wrote to memory of 3700 1980 cmd.exe 104 PID 3700 wrote to memory of 248 3700 DOE.exe 105 PID 248 wrote to memory of 3496 248 cmd.exe 109 PID 3496 wrote to memory of 1324 3496 UOS.exe 110 PID 1324 wrote to memory of 3448 1324 cmd.exe 114 PID 3448 wrote to memory of 2792 3448 NPA.exe 115 PID 2792 wrote to memory of 716 2792 cmd.exe 119 PID 716 wrote to memory of 5760 716 MAKTUNC.exe 120 PID 5760 wrote to memory of 1260 5760 cmd.exe 124 PID 1260 wrote to memory of 5612 1260 DIRRGEF.exe 125 PID 5612 wrote to memory of 3204 5612 cmd.exe 129 PID 3204 wrote to memory of 3532 3204 FYELON.exe 130 PID 3532 wrote to memory of 5052 3532 cmd.exe 134 PID 5052 wrote to memory of 3424 5052 BDEXP.exe 135 PID 3424 wrote to memory of 5284 3424 cmd.exe 139 PID 5284 wrote to memory of 4140 5284 VRWYJJ.exe 140 PID 4140 wrote to memory of 1244 4140 cmd.exe 144 PID 1244 wrote to memory of 4192 1244 TPJQRR.exe 145 PID 4192 wrote to memory of 1468 4192 cmd.exe 149 PID 1468 wrote to memory of 1300 1468 GMJC.exe 150 PID 1300 wrote to memory of 4332 1300 cmd.exe 154 PID 4332 wrote to memory of 4592 4332 QKXW.exe 155 PID 4592 wrote to memory of 5764 4592 cmd.exe 159 PID 5764 wrote to memory of 2396 5764 NLY.exe 160 PID 2396 wrote to memory of 5456 2396 cmd.exe 164 PID 5456 wrote to memory of 3604 5456 ELN.exe 165 PID 3604 wrote to memory of 4488 3604 cmd.exe 169 PID 4488 wrote to memory of 2384 4488 XORZMVS.exe 170 PID 2384 wrote to memory of 5204 2384 cmd.exe 174 PID 5204 wrote to memory of 2464 5204 OWFWYMN.exe 175 PID 2464 wrote to memory of 5756 2464 cmd.exe 179 PID 5756 wrote to memory of 988 5756 KZOVF.exe 180 PID 988 wrote to memory of 3188 988 cmd.exe 184 PID 3188 wrote to memory of 1240 3188 SNACP.exe 185 PID 1240 wrote to memory of 4160 1240 cmd.exe 189 PID 4160 wrote to memory of 564 4160 JIGUYF.exe 190 PID 564 wrote to memory of 3328 564 cmd.exe 194 PID 3328 wrote to memory of 3928 3328 WTPTMQ.exe 195 PID 3928 wrote to memory of 5516 3928 cmd.exe 199 PID 5516 wrote to memory of 4516 5516 QLEE.exe 200 PID 4516 wrote to memory of 2416 4516 cmd.exe 204 PID 2416 wrote to memory of 4640 2416 XBFVCFN.exe 205 PID 4640 wrote to memory of 6072 4640 cmd.exe 209 PID 6072 wrote to memory of 4280 6072 QUMGLFV.exe 210 PID 4280 wrote to memory of 4900 4280 cmd.exe 214 PID 4900 wrote to memory of 3284 4900 ARAABOE.exe 215 PID 3284 wrote to memory of 1036 3284 cmd.exe 219 PID 1036 wrote to memory of 1168 1036 OXAMD.exe 220 PID 1168 wrote to memory of 352 1168 cmd.exe 224 PID 352 wrote to memory of 3596 352 HQP.exe 225 PID 3596 wrote to memory of 4288 3596 cmd.exe 229 PID 4288 wrote to memory of 4904 4288 JNV.exe 230 PID 4904 wrote to memory of 928 4904 cmd.exe 234 PID 928 wrote to memory of 3212 928 IYYHCPT.exe 235 PID 3212 wrote to memory of 5720 3212 cmd.exe 239 PID 5720 wrote to memory of 1268 5720 BRNSTQB.exe 240 PID 1268 wrote to memory of 3288 1268 cmd.exe 244 PID 3288 wrote to memory of 5436 3288 JESZEO.exe 245 PID 5436 wrote to memory of 5188 5436 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_393bd6632693e606f3ad523ebe632bff_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\SysWOW64\LXL.exeC:\windows\system32\LXL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBKXB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\system\JBKXB.exeC:\windows\system\JBKXB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\SysWOW64\DOE.exeC:\windows\system32\DOE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOS.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\system\UOS.exeC:\windows\system\UOS.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NPA.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\system\NPA.exeC:\windows\system\NPA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MAKTUNC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\SysWOW64\MAKTUNC.exeC:\windows\system32\MAKTUNC.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIRRGEF.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\DIRRGEF.exeC:\windows\system32\DIRRGEF.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYELON.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\system\FYELON.exeC:\windows\system\FYELON.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDEXP.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\windows\SysWOW64\BDEXP.exeC:\windows\system32\BDEXP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRWYJJ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\windows\system\VRWYJJ.exeC:\windows\system\VRWYJJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPJQRR.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\system\TPJQRR.exeC:\windows\system\TPJQRR.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMJC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\SysWOW64\GMJC.exeC:\windows\system32\GMJC.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKXW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\SysWOW64\QKXW.exeC:\windows\system32\QKXW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLY.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\NLY.exeC:\windows\NLY.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\system\ELN.exeC:\windows\system\ELN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XORZMVS.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\XORZMVS.exeC:\windows\XORZMVS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWFWYMN.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\system\OWFWYMN.exeC:\windows\system\OWFWYMN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZOVF.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\SysWOW64\KZOVF.exeC:\windows\system32\KZOVF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNACP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\SNACP.exeC:\windows\SNACP.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIGUYF.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\SysWOW64\JIGUYF.exeC:\windows\system32\JIGUYF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTPTMQ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\windows\WTPTMQ.exeC:\windows\WTPTMQ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLEE.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\QLEE.exeC:\windows\QLEE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBFVCFN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\XBFVCFN.exeC:\windows\XBFVCFN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUMGLFV.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\QUMGLFV.exeC:\windows\system\QUMGLFV.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARAABOE.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\SysWOW64\ARAABOE.exeC:\windows\system32\ARAABOE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\OXAMD.exeC:\windows\OXAMD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HQP.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\HQP.exeC:\windows\HQP.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\SysWOW64\JNV.exeC:\windows\system32\JNV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYHCPT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\IYYHCPT.exeC:\windows\IYYHCPT.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\SysWOW64\JESZEO.exeC:\windows\system32\JESZEO.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUB.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\YUB.exeC:\windows\system32\YUB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "66⤵PID:3256
-
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KQMFA.exe.bat" "68⤵PID:1788
-
C:\windows\SysWOW64\KQMFA.exeC:\windows\system32\KQMFA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:6016 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDFU.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5352 -
C:\windows\WDFU.exeC:\windows\WDFU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZFU.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4676 -
C:\windows\CZFU.exeC:\windows\CZFU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMJB.exe.bat" "76⤵PID:2648
-
C:\windows\KMJB.exeC:\windows\KMJB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFZM.exe.bat" "78⤵PID:1796
-
C:\windows\system\WFZM.exeC:\windows\system\WFZM.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNHJC.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2716 -
C:\windows\SysWOW64\ZNHJC.exeC:\windows\system32\ZNHJC.exe81⤵
- Executes dropped EXE
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4408 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLJYXE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4876 -
C:\windows\SysWOW64\FLJYXE.exeC:\windows\system32\FLJYXE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5160 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZC.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\FZC.exeC:\windows\FZC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1188 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "96⤵PID:3296
-
C:\windows\IYIGE.exeC:\windows\IYIGE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1184 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "100⤵PID:5656
-
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4520 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2020 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDQ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\windows\SysWOW64\EDQ.exeC:\windows\system32\EDQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\windows\YRZD.exeC:\windows\YRZD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "112⤵
- Executes a command shell one-liner
PID:520 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXVUPNO.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3820 -
C:\windows\SysWOW64\LXVUPNO.exeC:\windows\system32\LXVUPNO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3908 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "118⤵PID:2028
-
C:\windows\JANS.exeC:\windows\JANS.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYN.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3600 -
C:\windows\SysWOW64\WYN.exeC:\windows\system32\WYN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-