Analysis
- max time kernel
77s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 20:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe
- Size 208KB
- Sample260813-yvjlfseq8z
- SHA256 40cec7645174fa28666f8598c5cbe09386ccbc1074b3e0a15896500b65b01cfa
- MD5 bc3affdb4fc2634e1aa0ad80736cef15
- SHA1 5dce4586880c034dbc583af6b0e73ff4561a9f6e
- SHA512 17630c70f94390d8019e66abb42a0a01f4c9d5f54208a030dd2816106f42af3dc8984a1b394dce898c3b201e39a78e81fa638985f999cbb05a4261302866c654
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfk4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOckEj1
- TLSH T1B5247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4336 ILFVNZC.exe 2900 DQGOU.exe 5500 QTO.exe 5220 DZO.exe 3764 CPITFLK.exe 2964 KCMAPK.exe 1828 LXQ.exe 5956 YDYPXLY.exe 5920 BQP.exe 4340 DOVLYNO.exe 5340 FWEAFH.exe 2480 PUJUUQ.exe 4448 OFMKV.exe 2876 FYXA.exe 2456 RGDAQU.exe 4812 QRGQY.exe 5376 THNQKSK.exe 4916 BMAFVZF.exe 2572 EHR.exe 4676 VSUXPQJ.exe 4668 FQZR.exe 3592 DBK.exe 2700 TRLYMAC.exe 1524 VPRT.exe 4776 HXX.exe 4552 UHORUL.exe 5744 TSQHC.exe 2772 CASNGXT.exe 3100 XOXW.exe 5492 XRBAW.exe 5800 KUJQK.exe 2028 YZRC.exe 716 CHYKYT.exe 5828 XSHB.exe 4292 QVK.exe 2844 KIPOC.exe 2408 LMTKHKX.exe 3948 EPFNVA.exe 3428 YCK.exe 2248 ZXNA.exe 2300 OAXFVKF.exe 4992 NLAVEQ.exe 2308 KLJXI.exe 1248 METNDTN.exe 5816 NHXRII.exe 4624 WUHJYF.exe 2904 LKIAF.exe 2612 VIWVMJH.exe 704 ODAYSZ.exe 3116 BOIP.exe 5176 HJHYLFU.exe 4104 PPUEVDP.exe 5480 FKDJ.exe 5636 BKFL.exe 1296 FAUTWM.exe 3308 ELWBF.exe 4580 QTDJRLN.exe 2544 SRJDZTO.exe 4860 SXJ.exe 5288 SANO.exe 1908 NNSXYW.exe 796 KTX.exe 2660 PTFIO.exe 3148 IWJETYU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PTFIO.exe KTX.exe File opened for modification C:\windows\SysWOW64\BQP.exe YDYPXLY.exe File created C:\windows\SysWOW64\FYXA.exe.bat OFMKV.exe File created C:\windows\SysWOW64\PPUEVDP.exe.bat HJHYLFU.exe File created C:\windows\SysWOW64\PTFIO.exe.bat KTX.exe File opened for modification C:\windows\SysWOW64\HKP.exe SUOYJGC.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe NXN.exe File opened for modification C:\windows\SysWOW64\BIBVDX.exe GUXEB.exe File created C:\windows\SysWOW64\XSHB.exe.bat CHYKYT.exe File created C:\windows\SysWOW64\RGDAQU.exe FYXA.exe File created C:\windows\SysWOW64\BMAFVZF.exe.bat THNQKSK.exe File opened for modification C:\windows\SysWOW64\YCK.exe EPFNVA.exe File created C:\windows\SysWOW64\HJHYLFU.exe.bat BOIP.exe File opened for modification C:\windows\SysWOW64\PPUEVDP.exe HJHYLFU.exe File opened for modification C:\windows\SysWOW64\XSHB.exe CHYKYT.exe File created C:\windows\SysWOW64\WUHJYF.exe.bat NHXRII.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe XTARLM.exe File created C:\windows\SysWOW64\THNQKSK.exe QRGQY.exe File created C:\windows\SysWOW64\PPUEVDP.exe HJHYLFU.exe File created C:\windows\SysWOW64\MREH.exe.bat SEZ.exe File opened for modification C:\windows\SysWOW64\NAAA.exe SMDIACS.exe File created C:\windows\SysWOW64\MBVHPPA.exe.bat SNY.exe File opened for modification C:\windows\SysWOW64\ACDF.exe AZRCT.exe File created C:\windows\SysWOW64\XSHB.exe CHYKYT.exe File created C:\windows\SysWOW64\NAAA.exe.bat SMDIACS.exe File created C:\windows\SysWOW64\XZSYNR.exe XTARLM.exe File created C:\windows\SysWOW64\ACDF.exe.bat AZRCT.exe File created C:\windows\SysWOW64\KTX.exe NNSXYW.exe File opened for modification C:\windows\SysWOW64\KUJQK.exe XRBAW.exe File created C:\windows\SysWOW64\KUJQK.exe.bat XRBAW.exe File created C:\windows\SysWOW64\RGDAQU.exe.bat FYXA.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat QRGQY.exe File created C:\windows\SysWOW64\BMAFVZF.exe THNQKSK.exe File opened for modification C:\windows\SysWOW64\HJHYLFU.exe BOIP.exe File created C:\windows\SysWOW64\IKSPV.exe NXN.exe File created C:\windows\SysWOW64\YDYPXLY.exe LXQ.exe File opened for modification C:\windows\SysWOW64\FYXA.exe OFMKV.exe File created C:\windows\SysWOW64\KUJQK.exe XRBAW.exe File created C:\windows\SysWOW64\EPFNVA.exe LMTKHKX.exe File opened for modification C:\windows\SysWOW64\KTX.exe NNSXYW.exe File created C:\windows\SysWOW64\HKP.exe SUOYJGC.exe File opened for modification C:\windows\SysWOW64\RQMBAF.exe TQF.exe File created C:\windows\SysWOW64\XRBAW.exe XOXW.exe File opened for modification C:\windows\SysWOW64\KLJXI.exe NLAVEQ.exe File created C:\windows\SysWOW64\SMDIACS.exe.bat MREH.exe File created C:\windows\SysWOW64\BQP.exe YDYPXLY.exe File created C:\windows\SysWOW64\LKIAF.exe WUHJYF.exe File created C:\windows\SysWOW64\RQMBAF.exe.bat TQF.exe File created C:\windows\SysWOW64\XTARLM.exe RTSDC.exe File created C:\windows\SysWOW64\XZSYNR.exe.bat XTARLM.exe File opened for modification C:\windows\SysWOW64\BMAFVZF.exe THNQKSK.exe File opened for modification C:\windows\SysWOW64\XRBAW.exe XOXW.exe File created C:\windows\SysWOW64\YCK.exe EPFNVA.exe File opened for modification C:\windows\SysWOW64\PTFIO.exe KTX.exe File created C:\windows\SysWOW64\MREH.exe SEZ.exe File created C:\windows\SysWOW64\NAAA.exe SMDIACS.exe File created C:\windows\SysWOW64\BQP.exe.bat YDYPXLY.exe File opened for modification C:\windows\SysWOW64\RGDAQU.exe FYXA.exe File created C:\windows\SysWOW64\XRBAW.exe.bat XOXW.exe File opened for modification C:\windows\SysWOW64\EPFNVA.exe LMTKHKX.exe File created C:\windows\SysWOW64\IWJETYU.exe PTFIO.exe File opened for modification C:\windows\SysWOW64\MREH.exe SEZ.exe File created C:\windows\SysWOW64\SMDIACS.exe MREH.exe File created C:\windows\SysWOW64\IKSPV.exe.bat NXN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\NLAVEQ.exe.bat OAXFVKF.exe File created C:\windows\SXJ.exe.bat SRJDZTO.exe File created C:\windows\TQF.exe.bat IXCUJWH.exe File created C:\windows\system\KCMAPK.exe.bat CPITFLK.exe File created C:\windows\system\VSUXPQJ.exe EHR.exe File opened for modification C:\windows\QVK.exe XSHB.exe File created C:\windows\ELWBF.exe.bat FAUTWM.exe File opened for modification C:\windows\NXN.exe OMCQ.exe File opened for modification C:\windows\system\ILFVNZC.exe 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe File created C:\windows\KIPOC.exe QVK.exe File created C:\windows\ZXNA.exe YCK.exe File created C:\windows\ZXNA.exe.bat YCK.exe File created C:\windows\system\BOIP.exe.bat ODAYSZ.exe File opened for modification C:\windows\system\IXCUJWH.exe RXAPXQ.exe File created C:\windows\QTO.exe.bat DQGOU.exe File created C:\windows\OFMKV.exe.bat PUJUUQ.exe File opened for modification C:\windows\system\NLAVEQ.exe OAXFVKF.exe File created C:\windows\SANO.exe SXJ.exe File created C:\windows\RTSDC.exe.bat RQOAXU.exe File created C:\windows\SNY.exe.bat ANWTBSJ.exe File opened for modification C:\windows\system\KCMAPK.exe CPITFLK.exe File created C:\windows\DBK.exe.bat FQZR.exe File created C:\windows\system\ODAYSZ.exe VIWVMJH.exe File opened for modification C:\windows\SANO.exe SXJ.exe File opened for modification C:\windows\ANWTBSJ.exe IKSPV.exe File opened for modification C:\windows\system\BJEAJ.exe SBCVYRJ.exe File created C:\windows\system\NHXRII.exe METNDTN.exe File created C:\windows\system\NHXRII.exe.bat METNDTN.exe File opened for modification C:\windows\VIWVMJH.exe LKIAF.exe File created C:\windows\system\TRLYMAC.exe.bat DBK.exe File created C:\windows\system\DZO.exe QTO.exe File created C:\windows\QRGQY.exe.bat RGDAQU.exe File opened for modification C:\windows\EHR.exe BMAFVZF.exe File opened for modification C:\windows\system\FQZR.exe VSUXPQJ.exe File opened for modification C:\windows\system\TRLYMAC.exe DBK.exe File created C:\windows\system\METNDTN.exe.bat NTQ.exe File opened for modification C:\windows\QTO.exe DQGOU.exe File opened for modification C:\windows\system\DZO.exe QTO.exe File created C:\windows\LXQ.exe.bat KCMAPK.exe File created C:\windows\system\FQZR.exe VSUXPQJ.exe File created C:\windows\system\YZRC.exe KUJQK.exe File created C:\windows\VIWVMJH.exe LKIAF.exe File created C:\windows\FWEAFH.exe DOVLYNO.exe File created C:\windows\VPRT.exe TRLYMAC.exe File created C:\windows\SRJDZTO.exe QTDJRLN.exe File created C:\windows\RQOAXU.exe.bat NAAA.exe File opened for modification C:\windows\RTSDC.exe RQOAXU.exe File created C:\windows\system\BJEAJ.exe SBCVYRJ.exe File opened for modification C:\windows\KVMF.exe BIBVDX.exe File opened for modification C:\windows\LXQ.exe KCMAPK.exe File opened for modification C:\windows\DBK.exe FQZR.exe File opened for modification C:\windows\system\HXX.exe VPRT.exe File created C:\windows\system\UHORUL.exe.bat HXX.exe File created C:\windows\system\OAXFVKF.exe ZXNA.exe File created C:\windows\system\OAXFVKF.exe.bat ZXNA.exe File opened for modification C:\windows\system\QTDJRLN.exe ELWBF.exe File created C:\windows\SRJDZTO.exe.bat QTDJRLN.exe File created C:\windows\QRGQY.exe RGDAQU.exe File created C:\windows\DBK.exe FQZR.exe File created C:\windows\system\CHYKYT.exe.bat YZRC.exe File opened for modification C:\windows\system\BOIP.exe ODAYSZ.exe File created C:\windows\TQF.exe IXCUJWH.exe File created C:\windows\NXN.exe OMCQ.exe File created C:\windows\system\REWMUJ.exe.bat BJEAJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5916 cmd.exe 3288 cmd.exe 1452 cmd.exe 2928 cmd.exe 1924 cmd.exe 4588 cmd.exe 5244 cmd.exe 3112 cmd.exe 1176 cmd.exe 2184 cmd.exe 3928 cmd.exe 5544 cmd.exe 1136 cmd.exe 3092 cmd.exe 4176 cmd.exe 4244 cmd.exe 3888 cmd.exe 5832 cmd.exe 1448 cmd.exe 5224 cmd.exe 4268 cmd.exe 4684 cmd.exe 2768 cmd.exe 5464 cmd.exe 2936 cmd.exe 1108 cmd.exe 2196 cmd.exe 5380 cmd.exe 476 cmd.exe 2648 cmd.exe 4524 cmd.exe 3372 cmd.exe 1444 cmd.exe 1608 cmd.exe 4716 cmd.exe 5404 cmd.exe 3572 cmd.exe 3832 cmd.exe 3516 cmd.exe 1284 cmd.exe 5668 cmd.exe 1792 cmd.exe 3344 cmd.exe 5672 cmd.exe 4920 cmd.exe 752 cmd.exe 5772 cmd.exe 3352 cmd.exe 2564 cmd.exe 3804 cmd.exe 5948 cmd.exe 4732 cmd.exe 240 cmd.exe 2756 cmd.exe 912 cmd.exe 256 cmd.exe 5656 cmd.exe 2868 cmd.exe 4664 cmd.exe 4756 cmd.exe 4428 cmd.exe 5640 cmd.exe 3208 cmd.exe 4504 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 796 5952 WerFault.exe 87 1248 4336 WerFault.exe 93 5304 2900 WerFault.exe 99 5456 5500 WerFault.exe 104 4220 5220 WerFault.exe 109 4200 3764 WerFault.exe 114 2564 2964 WerFault.exe 119 624 1828 WerFault.exe 124 5660 5956 WerFault.exe 129 1036 5920 WerFault.exe 134 1740 4340 WerFault.exe 139 4372 5340 WerFault.exe 144 256 2480 WerFault.exe 149 4244 4448 WerFault.exe 154 2408 2876 WerFault.exe 159 3716 2456 WerFault.exe 164 3220 4812 WerFault.exe 169 4456 5376 WerFault.exe 174 4604 4916 WerFault.exe 179 2784 2572 WerFault.exe 184 1096 4676 WerFault.exe 189 2860 4668 WerFault.exe 194 3344 3592 WerFault.exe 199 2508 2700 WerFault.exe 204 4904 1524 WerFault.exe 209 5456 4776 WerFault.exe 214 4728 4552 WerFault.exe 219 3888 5744 WerFault.exe 224 2556 2772 WerFault.exe 229 5328 3100 WerFault.exe 234 4772 5492 WerFault.exe 239 3204 5800 WerFault.exe 244 4208 2028 WerFault.exe 249 5092 716 WerFault.exe 254 1248 5828 WerFault.exe 259 5140 4292 WerFault.exe 264 4624 2844 WerFault.exe 270 3784 2408 WerFault.exe 275 1852 3948 WerFault.exe 280 2476 3428 WerFault.exe 285 3648 2248 WerFault.exe 290 2316 2300 WerFault.exe 295 4104 4992 WerFault.exe 300 1268 2308 WerFault.exe 305 1496 4228 WerFault.exe 310 3716 1248 WerFault.exe 315 3900 5816 WerFault.exe 319 4516 4624 WerFault.exe 325 1328 2904 WerFault.exe 330 4692 2612 WerFault.exe 335 5656 704 WerFault.exe 340 4756 3116 WerFault.exe 345 5356 5176 WerFault.exe 350 2628 4104 WerFault.exe 355 1496 5480 WerFault.exe 360 988 5636 WerFault.exe 365 2464 1296 WerFault.exe 370 1084 3308 WerFault.exe 375 6000 4580 WerFault.exe 380 5948 2544 WerFault.exe 385 4760 4860 WerFault.exe 390 4108 5288 WerFault.exe 395 2528 1908 WerFault.exe 400 4428 796 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUXEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFMKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMAFVZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAXFVKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRGQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMDIACS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDRKCFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLJXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRJDZTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTFIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSYNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZRCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILFVNZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOVLYNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHORUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODAYSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELWBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIPOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5952 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe 5952 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe 4336 ILFVNZC.exe 4336 ILFVNZC.exe 2900 DQGOU.exe 2900 DQGOU.exe 5500 QTO.exe 5500 QTO.exe 5220 DZO.exe 5220 DZO.exe 3764 CPITFLK.exe 3764 CPITFLK.exe 2964 KCMAPK.exe 2964 KCMAPK.exe 1828 LXQ.exe 1828 LXQ.exe 5956 YDYPXLY.exe 5956 YDYPXLY.exe 5920 BQP.exe 5920 BQP.exe 4340 DOVLYNO.exe 4340 DOVLYNO.exe 5340 FWEAFH.exe 5340 FWEAFH.exe 2480 PUJUUQ.exe 2480 PUJUUQ.exe 4448 OFMKV.exe 4448 OFMKV.exe 2876 FYXA.exe 2876 FYXA.exe 2456 RGDAQU.exe 2456 RGDAQU.exe 4812 QRGQY.exe 4812 QRGQY.exe 5376 THNQKSK.exe 5376 THNQKSK.exe 4916 BMAFVZF.exe 4916 BMAFVZF.exe 2572 EHR.exe 2572 EHR.exe 4676 VSUXPQJ.exe 4676 VSUXPQJ.exe 4668 FQZR.exe 4668 FQZR.exe 3592 DBK.exe 3592 DBK.exe 2700 TRLYMAC.exe 2700 TRLYMAC.exe 1524 VPRT.exe 1524 VPRT.exe 4776 HXX.exe 4776 HXX.exe 4552 UHORUL.exe 4552 UHORUL.exe 5744 TSQHC.exe 5744 TSQHC.exe 2772 CASNGXT.exe 2772 CASNGXT.exe 3100 XOXW.exe 3100 XOXW.exe 5492 XRBAW.exe 5492 XRBAW.exe 5800 KUJQK.exe 5800 KUJQK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5952 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe 5952 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe 4336 ILFVNZC.exe 4336 ILFVNZC.exe 2900 DQGOU.exe 2900 DQGOU.exe 5500 QTO.exe 5500 QTO.exe 5220 DZO.exe 5220 DZO.exe 3764 CPITFLK.exe 3764 CPITFLK.exe 2964 KCMAPK.exe 2964 KCMAPK.exe 1828 LXQ.exe 1828 LXQ.exe 5956 YDYPXLY.exe 5956 YDYPXLY.exe 5920 BQP.exe 5920 BQP.exe 4340 DOVLYNO.exe 4340 DOVLYNO.exe 5340 FWEAFH.exe 5340 FWEAFH.exe 2480 PUJUUQ.exe 2480 PUJUUQ.exe 4448 OFMKV.exe 4448 OFMKV.exe 2876 FYXA.exe 2876 FYXA.exe 2456 RGDAQU.exe 2456 RGDAQU.exe 4812 QRGQY.exe 4812 QRGQY.exe 5376 THNQKSK.exe 5376 THNQKSK.exe 4916 BMAFVZF.exe 4916 BMAFVZF.exe 2572 EHR.exe 2572 EHR.exe 4676 VSUXPQJ.exe 4676 VSUXPQJ.exe 4668 FQZR.exe 4668 FQZR.exe 3592 DBK.exe 3592 DBK.exe 2700 TRLYMAC.exe 2700 TRLYMAC.exe 1524 VPRT.exe 1524 VPRT.exe 4776 HXX.exe 4776 HXX.exe 4552 UHORUL.exe 4552 UHORUL.exe 5744 TSQHC.exe 5744 TSQHC.exe 2772 CASNGXT.exe 2772 CASNGXT.exe 3100 XOXW.exe 3100 XOXW.exe 5492 XRBAW.exe 5492 XRBAW.exe 5800 KUJQK.exe 5800 KUJQK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5952 wrote to memory of 5640 5952 2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe 89 PID 5640 wrote to memory of 4336 5640 cmd.exe 93 PID 4336 wrote to memory of 2560 4336 ILFVNZC.exe 95 PID 2560 wrote to memory of 2900 2560 cmd.exe 99 PID 2900 wrote to memory of 3352 2900 DQGOU.exe 100 PID 3352 wrote to memory of 5500 3352 cmd.exe 104 PID 5500 wrote to memory of 1184 5500 QTO.exe 105 PID 1184 wrote to memory of 5220 1184 cmd.exe 109 PID 5220 wrote to memory of 3208 5220 DZO.exe 110 PID 3208 wrote to memory of 3764 3208 cmd.exe 114 PID 3764 wrote to memory of 4864 3764 CPITFLK.exe 115 PID 4864 wrote to memory of 2964 4864 cmd.exe 119 PID 2964 wrote to memory of 1812 2964 KCMAPK.exe 120 PID 1812 wrote to memory of 1828 1812 cmd.exe 124 PID 1828 wrote to memory of 2584 1828 LXQ.exe 125 PID 2584 wrote to memory of 5956 2584 cmd.exe 129 PID 5956 wrote to memory of 5784 5956 YDYPXLY.exe 130 PID 5784 wrote to memory of 5920 5784 cmd.exe 134 PID 5920 wrote to memory of 700 5920 BQP.exe 135 PID 700 wrote to memory of 4340 700 cmd.exe 139 PID 4340 wrote to memory of 1944 4340 DOVLYNO.exe 140 PID 1944 wrote to memory of 5340 1944 cmd.exe 144 PID 5340 wrote to memory of 4968 5340 FWEAFH.exe 145 PID 4968 wrote to memory of 2480 4968 cmd.exe 149 PID 2480 wrote to memory of 2524 2480 PUJUUQ.exe 150 PID 2524 wrote to memory of 4448 2524 cmd.exe 154 PID 4448 wrote to memory of 1224 4448 OFMKV.exe 155 PID 1224 wrote to memory of 2876 1224 cmd.exe 159 PID 2876 wrote to memory of 912 2876 FYXA.exe 160 PID 912 wrote to memory of 2456 912 cmd.exe 164 PID 2456 wrote to memory of 5916 2456 RGDAQU.exe 165 PID 5916 wrote to memory of 4812 5916 cmd.exe 169 PID 4812 wrote to memory of 3060 4812 QRGQY.exe 170 PID 3060 wrote to memory of 5376 3060 cmd.exe 174 PID 5376 wrote to memory of 1792 5376 THNQKSK.exe 175 PID 1792 wrote to memory of 4916 1792 cmd.exe 179 PID 4916 wrote to memory of 2564 4916 BMAFVZF.exe 180 PID 2564 wrote to memory of 2572 2564 cmd.exe 184 PID 2572 wrote to memory of 6104 2572 EHR.exe 185 PID 6104 wrote to memory of 4676 6104 cmd.exe 189 PID 4676 wrote to memory of 6060 4676 VSUXPQJ.exe 190 PID 6060 wrote to memory of 4668 6060 cmd.exe 194 PID 4668 wrote to memory of 3256 4668 FQZR.exe 195 PID 3256 wrote to memory of 3592 3256 cmd.exe 199 PID 3592 wrote to memory of 3288 3592 DBK.exe 200 PID 3288 wrote to memory of 2700 3288 cmd.exe 204 PID 2700 wrote to memory of 5368 2700 TRLYMAC.exe 205 PID 5368 wrote to memory of 1524 5368 cmd.exe 209 PID 1524 wrote to memory of 5404 1524 VPRT.exe 210 PID 5404 wrote to memory of 4776 5404 cmd.exe 214 PID 4776 wrote to memory of 304 4776 HXX.exe 215 PID 304 wrote to memory of 4552 304 cmd.exe 219 PID 4552 wrote to memory of 3804 4552 UHORUL.exe 220 PID 3804 wrote to memory of 5744 3804 cmd.exe 224 PID 5744 wrote to memory of 4524 5744 TSQHC.exe 225 PID 4524 wrote to memory of 2772 4524 cmd.exe 229 PID 2772 wrote to memory of 1452 2772 CASNGXT.exe 230 PID 1452 wrote to memory of 3100 1452 cmd.exe 234 PID 3100 wrote to memory of 4712 3100 XOXW.exe 235 PID 4712 wrote to memory of 5492 4712 cmd.exe 239 PID 5492 wrote to memory of 1060 5492 XRBAW.exe 240 PID 1060 wrote to memory of 5800 1060 cmd.exe 244 PID 5800 wrote to memory of 1536 5800 KUJQK.exe 245 PID 1536 wrote to memory of 2028 1536 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_bc3affdb4fc2634e1aa0ad80736cef15_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILFVNZC.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\system\ILFVNZC.exeC:\windows\system\ILFVNZC.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\QTO.exeC:\windows\QTO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZO.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\windows\system\DZO.exeC:\windows\system\DZO.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPITFLK.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\CPITFLK.exeC:\windows\CPITFLK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KCMAPK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\system\KCMAPK.exeC:\windows\system\KCMAPK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\windows\LXQ.exeC:\windows\LXQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDYPXLY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\SysWOW64\YDYPXLY.exeC:\windows\system32\YDYPXLY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWEAFH.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\FWEAFH.exeC:\windows\FWEAFH.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFMKV.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\OFMKV.exeC:\windows\OFMKV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGDAQU.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\windows\SysWOW64\RGDAQU.exeC:\windows\system32\RGDAQU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\windows\SysWOW64\BMAFVZF.exeC:\windows\system32\BMAFVZF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\EHR.exeC:\windows\EHR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQZR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\system\FQZR.exeC:\windows\system\FQZR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBK.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\DBK.exeC:\windows\DBK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRLYMAC.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\system\TRLYMAC.exeC:\windows\system\TRLYMAC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\VPRT.exeC:\windows\VPRT.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHORUL.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:304 -
C:\windows\system\UHORUL.exeC:\windows\system\UHORUL.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOXW.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\XOXW.exeC:\windows\XOXW.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRBAW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\SysWOW64\XRBAW.exeC:\windows\system32\XRBAW.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4984 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3344 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVK.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\windows\QVK.exeC:\windows\QVK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "72⤵
- Executes a command shell one-liner
PID:256 -
C:\windows\KIPOC.exeC:\windows\KIPOC.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "74⤵PID:6068
-
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPFNVA.exe.bat" "76⤵PID:5332
-
C:\windows\SysWOW64\EPFNVA.exeC:\windows\system32\EPFNVA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\windows\SysWOW64\YCK.exeC:\windows\system32\YCK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXNA.exe.bat" "80⤵PID:1548
-
C:\windows\ZXNA.exeC:\windows\ZXNA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "82⤵PID:4772
-
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2928 -
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTQ.exe.bat" "88⤵PID:4128
-
C:\windows\NTQ.exeC:\windows\NTQ.exe89⤵
- Drops file in Windows directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3572 -
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "92⤵PID:2164
-
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4504 -
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKIAF.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2936 -
C:\windows\SysWOW64\LKIAF.exeC:\windows\system32\LKIAF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "98⤵PID:3080
-
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODAYSZ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\windows\system\ODAYSZ.exeC:\windows\system\ODAYSZ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOIP.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\windows\system\BOIP.exeC:\windows\system\BOIP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJHYLFU.exe.bat" "104⤵PID:5572
-
C:\windows\SysWOW64\HJHYLFU.exeC:\windows\system32\HJHYLFU.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "106⤵PID:1576
-
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe107⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKDJ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5672 -
C:\windows\system\FKDJ.exeC:\windows\system\FKDJ.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "110⤵PID:5060
-
C:\windows\BKFL.exeC:\windows\BKFL.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "112⤵PID:5076
-
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELWBF.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3888 -
C:\windows\ELWBF.exeC:\windows\ELWBF.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTDJRLN.exe.bat" "116⤵PID:1140
-
C:\windows\system\QTDJRLN.exeC:\windows\system\QTDJRLN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "118⤵PID:4156
-
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXJ.exe.bat" "120⤵PID:5696
-
C:\windows\SXJ.exeC:\windows\SXJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-