Analysis
- max time kernel
81s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe
- Size 208KB
- Sample260816-txlrda1hph
- SHA256 4a8f87c092f1fd9dc6a6b52b17fba288ac29319547c0d766c1d68266eb3277cb
- MD5 f62d74f9cf4d847e27dad356c3cd6085
- SHA1 4f31e611de896c7b26a69ce8d959b37fd944ab3c
- SHA512 f1a0082a2ed56aca969933699f74c1cf64f85d4047cc46e637abed3891628ae6ba445b4de037c5eb0efc3312d0f49f01468f279d35364f3e5db8d5040ea1fee5
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOf74pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LODkEj1
- TLSH T1CC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2596 TLGMD.exe 1132 KERS.exe 5504 BEFQ.exe 5868 SPI.exe 3548 TSMJV.exe 3004 IIZBDUO.exe 1828 BIPMU.exe 4184 ATRU.exe 3024 ORR.exe 3200 HKH.exe 4240 GCKHXUG.exe 1340 XDYMJLB.exe 4244 QGCIPB.exe 3944 OQF.exe 772 AGGYTK.exe 3440 OEGKV.exe 2804 YCLWCEF.exe 5148 AAZQRNG.exe 4308 FAHE.exe 4168 ELJUJV.exe 4324 DEMKS.exe 2248 HMTK.exe 5660 PZFZ.exe 4948 ZPLLWA.exe 5964 BNZFDJ.exe 4808 SVBKHOD.exe 5664 LYEO.exe 4448 QRGQY.exe 6000 THNQKSK.exe 4204 MKRU.exe 4936 YSFUCAH.exe 2344 JKNFMBP.exe 5368 BTP.exe 4272 TOTOCXT.exe 964 URWS.exe 3308 PEBBSM.exe 6096 SUIBE.exe 3884 MMX.exe 788 TCYLVTK.exe 3112 FLFL.exe 2556 OTHRK.exe 2724 YRULS.exe 3632 CZBTEKF.exe 5040 GPITQ.exe 1212 QPK.exe 124 ZNPSB.exe 1120 UAUCLIS.exe 4644 VDYGRY.exe 3164 XBM.exe 1520 XEPWMEE.exe 5656 QHTR.exe 1840 YNYG.exe 4832 CDMGOL.exe 776 DYQCT.exe 264 HOXKGTV.exe 860 HJBF.exe 1900 JGGA.exe 4528 VWNINJ.exe 4908 OAZDS.exe 5832 YXE.exe 4232 FFFPGV.exe 1312 PDLK.exe 4432 OWW.exe 5264 GRAVKH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OAZDS.exe VWNINJ.exe File opened for modification C:\windows\SysWOW64\XYD.exe TQXOM.exe File opened for modification C:\windows\SysWOW64\HVJIGPW.exe XYD.exe File opened for modification C:\windows\SysWOW64\URWS.exe TOTOCXT.exe File created C:\windows\SysWOW64\JGGA.exe HJBF.exe File created C:\windows\SysWOW64\OWW.exe PDLK.exe File opened for modification C:\windows\SysWOW64\KPVB.exe YZOAWYJ.exe File created C:\windows\SysWOW64\XYD.exe.bat TQXOM.exe File opened for modification C:\windows\SysWOW64\BLAB.exe TGIM.exe File created C:\windows\SysWOW64\EVIB.exe PFHCAO.exe File created C:\windows\SysWOW64\KEVFHDL.exe UOU.exe File created C:\windows\SysWOW64\XDYMJLB.exe GCKHXUG.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat QRGQY.exe File created C:\windows\SysWOW64\XYD.exe TQXOM.exe File created C:\windows\SysWOW64\HVJIGPW.exe XYD.exe File opened for modification C:\windows\SysWOW64\FAHE.exe AAZQRNG.exe File created C:\windows\SysWOW64\FAHE.exe.bat AAZQRNG.exe File created C:\windows\SysWOW64\SVBKHOD.exe.bat BNZFDJ.exe File created C:\windows\SysWOW64\PFHCAO.exe WCVG.exe File created C:\windows\SysWOW64\PFHCAO.exe.bat WCVG.exe File created C:\windows\SysWOW64\WCDPJKL.exe OOZ.exe File created C:\windows\SysWOW64\QGCIPB.exe XDYMJLB.exe File opened for modification C:\windows\SysWOW64\GPITQ.exe CZBTEKF.exe File opened for modification C:\windows\SysWOW64\ZNPSB.exe QPK.exe File created C:\windows\SysWOW64\TQXOM.exe.bat KPVB.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat OOZ.exe File opened for modification C:\windows\SysWOW64\ELUZ.exe WXPL.exe File created C:\windows\SysWOW64\BEFQ.exe.bat KERS.exe File created C:\windows\SysWOW64\AAZQRNG.exe YCLWCEF.exe File created C:\windows\SysWOW64\YRULS.exe OTHRK.exe File created C:\windows\SysWOW64\TQXOM.exe KPVB.exe File opened for modification C:\windows\SysWOW64\TQXOM.exe KPVB.exe File created C:\windows\SysWOW64\FLFL.exe.bat TCYLVTK.exe File created C:\windows\SysWOW64\JGGA.exe.bat HJBF.exe File created C:\windows\SysWOW64\KPVB.exe.bat YZOAWYJ.exe File created C:\windows\SysWOW64\HVJIGPW.exe.bat XYD.exe File opened for modification C:\windows\SysWOW64\EVIB.exe PFHCAO.exe File created C:\windows\SysWOW64\EOXDV.exe.bat PLNRCTN.exe File created C:\windows\SysWOW64\KERS.exe TLGMD.exe File created C:\windows\SysWOW64\XDYMJLB.exe.bat GCKHXUG.exe File created C:\windows\SysWOW64\QGCIPB.exe.bat XDYMJLB.exe File opened for modification C:\windows\SysWOW64\AAZQRNG.exe YCLWCEF.exe File created C:\windows\SysWOW64\THNQKSK.exe QRGQY.exe File created C:\windows\SysWOW64\URWS.exe.bat TOTOCXT.exe File created C:\windows\SysWOW64\OAZDS.exe.bat VWNINJ.exe File opened for modification C:\windows\SysWOW64\OWW.exe PDLK.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat YCLWCEF.exe File created C:\windows\SysWOW64\SVBKHOD.exe BNZFDJ.exe File created C:\windows\SysWOW64\URWS.exe TOTOCXT.exe File created C:\windows\SysWOW64\OWW.exe.bat PDLK.exe File created C:\windows\SysWOW64\BLAB.exe.bat TGIM.exe File opened for modification C:\windows\SysWOW64\EOXDV.exe PLNRCTN.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe OOZ.exe File opened for modification C:\windows\SysWOW64\SVBKHOD.exe BNZFDJ.exe File opened for modification C:\windows\SysWOW64\THNQKSK.exe QRGQY.exe File created C:\windows\SysWOW64\MMX.exe SUIBE.exe File created C:\windows\SysWOW64\FLFL.exe TCYLVTK.exe File opened for modification C:\windows\SysWOW64\YRULS.exe OTHRK.exe File created C:\windows\SysWOW64\GPITQ.exe.bat CZBTEKF.exe File opened for modification C:\windows\SysWOW64\OAZDS.exe VWNINJ.exe File created C:\windows\SysWOW64\EOXDV.exe PLNRCTN.exe File created C:\windows\SysWOW64\KPVB.exe YZOAWYJ.exe File created C:\windows\SysWOW64\BLAB.exe TGIM.exe File created C:\windows\SysWOW64\UOU.exe QGNGWP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LIVE.exe SPFT.exe File created C:\windows\BDWMDVL.exe ZGQSNNK.exe File created C:\windows\OEGKV.exe.bat AGGYTK.exe File opened for modification C:\windows\system\TOTOCXT.exe BTP.exe File opened for modification C:\windows\system\PEBBSM.exe URWS.exe File opened for modification C:\windows\system\XBM.exe VDYGRY.exe File created C:\windows\GRAVKH.exe OWW.exe File opened for modification C:\windows\FII.exe DKUW.exe File created C:\windows\OQF.exe.bat QGCIPB.exe File opened for modification C:\windows\system\YCLWCEF.exe OEGKV.exe File opened for modification C:\windows\HMTK.exe DEMKS.exe File created C:\windows\system\SUIBE.exe PEBBSM.exe File created C:\windows\QPK.exe.bat GPITQ.exe File opened for modification C:\windows\YZOAWYJ.exe GRAVKH.exe File opened for modification C:\windows\system\ZGQSNNK.exe EVIB.exe File created C:\windows\system\BQMP.exe.bat ELUZ.exe File opened for modification C:\windows\system\TSMJV.exe SPI.exe File created C:\windows\system\BIPMU.exe IIZBDUO.exe File created C:\windows\system\UAUCLIS.exe ZNPSB.exe File opened for modification C:\windows\VWNINJ.exe JGGA.exe File created C:\windows\system\WXPL.exe.bat WCDPJKL.exe File created C:\windows\system\TCYLVTK.exe MMX.exe File opened for modification C:\windows\system\UAUCLIS.exe ZNPSB.exe File created C:\windows\XEPWMEE.exe XBM.exe File created C:\windows\XEPWMEE.exe.bat XBM.exe File opened for modification C:\windows\PDLK.exe FFFPGV.exe File created C:\windows\ATRU.exe BIPMU.exe File opened for modification C:\windows\ATRU.exe BIPMU.exe File opened for modification C:\windows\DEMKS.exe ELJUJV.exe File created C:\windows\system\TOTOCXT.exe.bat BTP.exe File opened for modification C:\windows\HOXKGTV.exe DYQCT.exe File created C:\windows\VWNINJ.exe.bat JGGA.exe File opened for modification C:\windows\YSFUCAH.exe MKRU.exe File created C:\windows\system\QHTR.exe XEPWMEE.exe File created C:\windows\CDMGOL.exe YNYG.exe File created C:\windows\CDMGOL.exe.bat YNYG.exe File created C:\windows\GRAVKH.exe.bat OWW.exe File opened for modification C:\windows\RHBJYW.exe JTWUNXF.exe File opened for modification C:\windows\SPFT.exe IHD.exe File created C:\windows\system\TGIM.exe ELYICP.exe File opened for modification C:\windows\OEGKV.exe AGGYTK.exe File created C:\windows\PZFZ.exe.bat HMTK.exe File created C:\windows\RCNOZFF.exe PEIBKWW.exe File created C:\windows\HKH.exe ORR.exe File created C:\windows\ZPLLWA.exe.bat PZFZ.exe File created C:\windows\system\LYEO.exe.bat SVBKHOD.exe File created C:\windows\OTHRK.exe.bat FLFL.exe File created C:\windows\system\JTWUNXF.exe.bat HVJIGPW.exe File created C:\windows\RCNOZFF.exe.bat PEIBKWW.exe File created C:\windows\system\QGNGWP.exe BQMP.exe File created C:\windows\SPI.exe.bat BEFQ.exe File opened for modification C:\windows\OQF.exe QGCIPB.exe File created C:\windows\PZFZ.exe HMTK.exe File created C:\windows\ZPLLWA.exe PZFZ.exe File created C:\windows\BNZFDJ.exe ZPLLWA.exe File created C:\windows\YSFUCAH.exe.bat MKRU.exe File opened for modification C:\windows\XEPWMEE.exe XBM.exe File created C:\windows\system\HJBF.exe HOXKGTV.exe File created C:\windows\system\GCKHXUG.exe HKH.exe File opened for modification C:\windows\QRGQY.exe LYEO.exe File created C:\windows\MKRU.exe.bat THNQKSK.exe File created C:\windows\system\PEBBSM.exe.bat URWS.exe File created C:\windows\CZBTEKF.exe YRULS.exe File opened for modification C:\windows\CZBTEKF.exe YRULS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5072 cmd.exe 4732 cmd.exe 3428 cmd.exe 1736 cmd.exe 4656 cmd.exe 1640 cmd.exe 4188 cmd.exe 1876 cmd.exe 3132 cmd.exe 6064 cmd.exe 4896 cmd.exe 2616 cmd.exe 688 cmd.exe 3844 cmd.exe 2972 cmd.exe 3216 cmd.exe 2028 cmd.exe 3980 cmd.exe 5356 cmd.exe 6120 cmd.exe 5492 cmd.exe 3032 cmd.exe 1996 cmd.exe 5028 cmd.exe 1560 cmd.exe 1496 cmd.exe 796 cmd.exe 2188 cmd.exe 2716 cmd.exe 5440 cmd.exe 2572 cmd.exe 1668 cmd.exe 5452 cmd.exe 3224 cmd.exe 200 cmd.exe 1500 cmd.exe 6048 cmd.exe 4228 cmd.exe 3680 cmd.exe 4132 cmd.exe 5812 cmd.exe 2800 cmd.exe 1720 cmd.exe 4540 cmd.exe 3144 cmd.exe 5792 cmd.exe 5888 cmd.exe 1256 cmd.exe 5988 cmd.exe 856 cmd.exe 4912 cmd.exe 1844 cmd.exe 3084 cmd.exe 5800 cmd.exe 4688 cmd.exe 992 cmd.exe 2196 cmd.exe 4928 cmd.exe 5848 cmd.exe 1140 cmd.exe 2776 cmd.exe 3172 cmd.exe 3640 cmd.exe 4884 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1416 1208 WerFault.exe 88 2136 2596 WerFault.exe 93 1912 1132 WerFault.exe 99 5908 5504 WerFault.exe 104 856 5868 WerFault.exe 109 2016 3548 WerFault.exe 114 4732 3004 WerFault.exe 119 4456 1828 WerFault.exe 124 688 4184 WerFault.exe 129 5140 3024 WerFault.exe 134 5368 3200 WerFault.exe 139 5404 4240 WerFault.exe 144 4452 1340 WerFault.exe 149 4360 4244 WerFault.exe 154 4692 3944 WerFault.exe 159 3564 772 WerFault.exe 164 4448 3440 WerFault.exe 169 6000 2804 WerFault.exe 174 2392 5148 WerFault.exe 178 3480 4308 WerFault.exe 184 832 4168 WerFault.exe 189 2352 4324 WerFault.exe 194 5404 2248 WerFault.exe 199 5464 5660 WerFault.exe 204 4784 4948 WerFault.exe 209 244 5964 WerFault.exe 214 5396 4808 WerFault.exe 219 3520 5664 WerFault.exe 224 564 4448 WerFault.exe 229 2096 6000 WerFault.exe 234 2304 4204 WerFault.exe 239 6108 4936 WerFault.exe 244 5004 2344 WerFault.exe 249 4296 5368 WerFault.exe 254 4452 4272 WerFault.exe 259 2884 964 WerFault.exe 265 860 3308 WerFault.exe 270 5564 6096 WerFault.exe 275 4556 3884 WerFault.exe 280 3396 788 WerFault.exe 285 1592 3112 WerFault.exe 290 4480 2556 WerFault.exe 295 4336 2724 WerFault.exe 300 4900 3632 WerFault.exe 305 4440 5040 WerFault.exe 310 1940 1212 WerFault.exe 315 2268 124 WerFault.exe 320 4708 1120 WerFault.exe 325 1252 4644 WerFault.exe 330 1168 3164 WerFault.exe 335 3220 1520 WerFault.exe 340 4868 5656 WerFault.exe 345 5256 1840 WerFault.exe 350 1124 4832 WerFault.exe 355 5812 776 WerFault.exe 360 244 264 WerFault.exe 365 3496 860 WerFault.exe 370 5388 1900 WerFault.exe 375 2648 4528 WerFault.exe 379 5068 4908 WerFault.exe 385 3460 5832 WerFault.exe 390 1876 4232 WerFault.exe 395 4640 1312 WerFault.exe 400 2324 4432 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWNINJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQXOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCNOZFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYOQFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOHCLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPLLWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOTOCXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELJUJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRGQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAUCLIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFHCAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIPMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVJIGPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEMKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEBBSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPITQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEPWMEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTWUNXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THNQKSK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe 1208 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe 2596 TLGMD.exe 2596 TLGMD.exe 1132 KERS.exe 1132 KERS.exe 5504 BEFQ.exe 5504 BEFQ.exe 5868 SPI.exe 5868 SPI.exe 3548 TSMJV.exe 3548 TSMJV.exe 3004 IIZBDUO.exe 3004 IIZBDUO.exe 1828 BIPMU.exe 1828 BIPMU.exe 4184 ATRU.exe 4184 ATRU.exe 3024 ORR.exe 3024 ORR.exe 3200 HKH.exe 3200 HKH.exe 4240 GCKHXUG.exe 4240 GCKHXUG.exe 1340 XDYMJLB.exe 1340 XDYMJLB.exe 4244 QGCIPB.exe 4244 QGCIPB.exe 3944 OQF.exe 3944 OQF.exe 772 AGGYTK.exe 772 AGGYTK.exe 3440 OEGKV.exe 3440 OEGKV.exe 2804 YCLWCEF.exe 2804 YCLWCEF.exe 5148 AAZQRNG.exe 5148 AAZQRNG.exe 4308 FAHE.exe 4308 FAHE.exe 4168 ELJUJV.exe 4168 ELJUJV.exe 4324 DEMKS.exe 4324 DEMKS.exe 2248 HMTK.exe 2248 HMTK.exe 5660 PZFZ.exe 5660 PZFZ.exe 4948 ZPLLWA.exe 4948 ZPLLWA.exe 5964 BNZFDJ.exe 5964 BNZFDJ.exe 4808 SVBKHOD.exe 4808 SVBKHOD.exe 5664 LYEO.exe 5664 LYEO.exe 4448 QRGQY.exe 4448 QRGQY.exe 6000 THNQKSK.exe 6000 THNQKSK.exe 4204 MKRU.exe 4204 MKRU.exe 4936 YSFUCAH.exe 4936 YSFUCAH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1208 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe 1208 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe 2596 TLGMD.exe 2596 TLGMD.exe 1132 KERS.exe 1132 KERS.exe 5504 BEFQ.exe 5504 BEFQ.exe 5868 SPI.exe 5868 SPI.exe 3548 TSMJV.exe 3548 TSMJV.exe 3004 IIZBDUO.exe 3004 IIZBDUO.exe 1828 BIPMU.exe 1828 BIPMU.exe 4184 ATRU.exe 4184 ATRU.exe 3024 ORR.exe 3024 ORR.exe 3200 HKH.exe 3200 HKH.exe 4240 GCKHXUG.exe 4240 GCKHXUG.exe 1340 XDYMJLB.exe 1340 XDYMJLB.exe 4244 QGCIPB.exe 4244 QGCIPB.exe 3944 OQF.exe 3944 OQF.exe 772 AGGYTK.exe 772 AGGYTK.exe 3440 OEGKV.exe 3440 OEGKV.exe 2804 YCLWCEF.exe 2804 YCLWCEF.exe 5148 AAZQRNG.exe 5148 AAZQRNG.exe 4308 FAHE.exe 4308 FAHE.exe 4168 ELJUJV.exe 4168 ELJUJV.exe 4324 DEMKS.exe 4324 DEMKS.exe 2248 HMTK.exe 2248 HMTK.exe 5660 PZFZ.exe 5660 PZFZ.exe 4948 ZPLLWA.exe 4948 ZPLLWA.exe 5964 BNZFDJ.exe 5964 BNZFDJ.exe 4808 SVBKHOD.exe 4808 SVBKHOD.exe 5664 LYEO.exe 5664 LYEO.exe 4448 QRGQY.exe 4448 QRGQY.exe 6000 THNQKSK.exe 6000 THNQKSK.exe 4204 MKRU.exe 4204 MKRU.exe 4936 YSFUCAH.exe 4936 YSFUCAH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1468 1208 2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe 89 PID 1468 wrote to memory of 2596 1468 cmd.exe 93 PID 2596 wrote to memory of 5440 2596 TLGMD.exe 95 PID 5440 wrote to memory of 1132 5440 cmd.exe 99 PID 1132 wrote to memory of 2936 1132 KERS.exe 100 PID 2936 wrote to memory of 5504 2936 cmd.exe 104 PID 5504 wrote to memory of 4348 5504 BEFQ.exe 105 PID 4348 wrote to memory of 5868 4348 cmd.exe 109 PID 5868 wrote to memory of 2516 5868 SPI.exe 110 PID 2516 wrote to memory of 3548 2516 cmd.exe 114 PID 3548 wrote to memory of 3008 3548 TSMJV.exe 115 PID 3008 wrote to memory of 3004 3008 cmd.exe 119 PID 3004 wrote to memory of 4656 3004 IIZBDUO.exe 120 PID 4656 wrote to memory of 1828 4656 cmd.exe 124 PID 1828 wrote to memory of 2572 1828 BIPMU.exe 125 PID 2572 wrote to memory of 4184 2572 cmd.exe 129 PID 4184 wrote to memory of 4516 4184 ATRU.exe 130 PID 4516 wrote to memory of 3024 4516 cmd.exe 134 PID 3024 wrote to memory of 1140 3024 ORR.exe 135 PID 1140 wrote to memory of 3200 1140 cmd.exe 139 PID 3200 wrote to memory of 2508 3200 HKH.exe 140 PID 2508 wrote to memory of 4240 2508 cmd.exe 144 PID 4240 wrote to memory of 2680 4240 GCKHXUG.exe 145 PID 2680 wrote to memory of 1340 2680 cmd.exe 149 PID 1340 wrote to memory of 4880 1340 XDYMJLB.exe 150 PID 4880 wrote to memory of 4244 4880 cmd.exe 154 PID 4244 wrote to memory of 2328 4244 QGCIPB.exe 155 PID 2328 wrote to memory of 3944 2328 cmd.exe 159 PID 3944 wrote to memory of 6048 3944 OQF.exe 160 PID 6048 wrote to memory of 772 6048 cmd.exe 164 PID 772 wrote to memory of 5488 772 AGGYTK.exe 165 PID 5488 wrote to memory of 3440 5488 cmd.exe 169 PID 3440 wrote to memory of 2836 3440 OEGKV.exe 170 PID 2836 wrote to memory of 2804 2836 cmd.exe 174 PID 2804 wrote to memory of 2920 2804 YCLWCEF.exe 175 PID 2920 wrote to memory of 5148 2920 cmd.exe 178 PID 5148 wrote to memory of 3032 5148 AAZQRNG.exe 180 PID 3032 wrote to memory of 4308 3032 cmd.exe 184 PID 4308 wrote to memory of 5136 4308 FAHE.exe 185 PID 5136 wrote to memory of 4168 5136 cmd.exe 189 PID 4168 wrote to memory of 4500 4168 ELJUJV.exe 190 PID 4500 wrote to memory of 4324 4500 cmd.exe 194 PID 4324 wrote to memory of 4604 4324 DEMKS.exe 195 PID 4604 wrote to memory of 2248 4604 cmd.exe 199 PID 2248 wrote to memory of 1996 2248 HMTK.exe 200 PID 1996 wrote to memory of 5660 1996 cmd.exe 204 PID 5660 wrote to memory of 5752 5660 PZFZ.exe 205 PID 5752 wrote to memory of 4948 5752 cmd.exe 209 PID 4948 wrote to memory of 1256 4948 ZPLLWA.exe 210 PID 1256 wrote to memory of 5964 1256 cmd.exe 214 PID 5964 wrote to memory of 3464 5964 BNZFDJ.exe 215 PID 3464 wrote to memory of 4808 3464 cmd.exe 219 PID 4808 wrote to memory of 4228 4808 SVBKHOD.exe 220 PID 4228 wrote to memory of 5664 4228 cmd.exe 224 PID 5664 wrote to memory of 5616 5664 LYEO.exe 225 PID 5616 wrote to memory of 4448 5616 cmd.exe 229 PID 4448 wrote to memory of 1760 4448 QRGQY.exe 230 PID 1760 wrote to memory of 6000 1760 cmd.exe 234 PID 6000 wrote to memory of 5020 6000 THNQKSK.exe 235 PID 5020 wrote to memory of 4204 5020 cmd.exe 239 PID 4204 wrote to memory of 1644 4204 MKRU.exe 240 PID 1644 wrote to memory of 4936 1644 cmd.exe 244 PID 4936 wrote to memory of 5128 4936 YSFUCAH.exe 245 PID 5128 wrote to memory of 2344 5128 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f62d74f9cf4d847e27dad356c3cd6085_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLGMD.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\TLGMD.exeC:\windows\TLGMD.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KERS.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\windows\SysWOW64\KERS.exeC:\windows\system32\KERS.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEFQ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\SysWOW64\BEFQ.exeC:\windows\system32\BEFQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPI.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\SPI.exeC:\windows\SPI.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSMJV.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\system\TSMJV.exeC:\windows\system\TSMJV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIZBDUO.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\system\IIZBDUO.exeC:\windows\system\IIZBDUO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIPMU.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\system\BIPMU.exeC:\windows\system\BIPMU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATRU.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\ATRU.exeC:\windows\ATRU.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\ORR.exeC:\windows\ORR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKH.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\HKH.exeC:\windows\HKH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCKHXUG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\GCKHXUG.exeC:\windows\system\GCKHXUG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDYMJLB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\SysWOW64\XDYMJLB.exeC:\windows\system32\XDYMJLB.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGCIPB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\SysWOW64\QGCIPB.exeC:\windows\system32\QGCIPB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQF.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\OQF.exeC:\windows\OQF.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCLWCEF.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\system\YCLWCEF.exeC:\windows\system\YCLWCEF.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAHE.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\SysWOW64\FAHE.exeC:\windows\system32\FAHE.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEMKS.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\DEMKS.exeC:\windows\DEMKS.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\HMTK.exeC:\windows\HMTK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPLLWA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\ZPLLWA.exeC:\windows\ZPLLWA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNZFDJ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\BNZFDJ.exeC:\windows\BNZFDJ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYEO.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\LYEO.exeC:\windows\system\LYEO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRGQY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\QRGQY.exeC:\windows\QRGQY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKRU.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\MKRU.exeC:\windows\MKRU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNFMBP.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\windows\system\JKNFMBP.exeC:\windows\system\JKNFMBP.exe65⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "66⤵PID:2460
-
C:\windows\system\BTP.exeC:\windows\system\BTP.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOTOCXT.exe.bat" "68⤵PID:1056
-
C:\windows\system\TOTOCXT.exeC:\windows\system\TOTOCXT.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "70⤵PID:4800
-
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEBBSM.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1844 -
C:\windows\system\PEBBSM.exeC:\windows\system\PEBBSM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2776 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "76⤵PID:2368
-
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1668 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "80⤵PID:4092
-
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1720 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZBTEKF.exe.bat" "86⤵PID:4764
-
C:\windows\CZBTEKF.exeC:\windows\CZBTEKF.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPITQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5452 -
C:\windows\SysWOW64\GPITQ.exeC:\windows\system32\GPITQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPK.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5028 -
C:\windows\QPK.exeC:\windows\QPK.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNPSB.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1640 -
C:\windows\SysWOW64\ZNPSB.exeC:\windows\system32\ZNPSB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAUCLIS.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4188 -
C:\windows\system\UAUCLIS.exeC:\windows\system\UAUCLIS.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDYGRY.exe.bat" "96⤵PID:2400
-
C:\windows\VDYGRY.exeC:\windows\VDYGRY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBM.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\windows\system\XBM.exeC:\windows\system\XBM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEPWMEE.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5764 -
C:\windows\XEPWMEE.exeC:\windows\XEPWMEE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3172 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3680 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDMGOL.exe.bat" "106⤵PID:5348
-
C:\windows\CDMGOL.exeC:\windows\CDMGOL.exe107⤵
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "108⤵PID:4072
-
C:\windows\DYQCT.exeC:\windows\DYQCT.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "110⤵PID:5088
-
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "112⤵PID:3276
-
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGGA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2028 -
C:\windows\SysWOW64\JGGA.exeC:\windows\system32\JGGA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWNINJ.exe.bat" "116⤵PID:4276
-
C:\windows\VWNINJ.exeC:\windows\VWNINJ.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OAZDS.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\windows\SysWOW64\OAZDS.exeC:\windows\system32\OAZDS.exe119⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe121⤵
- Executes dropped EXE
PID:5832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-