Analysis
- max time kernel
71s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe
- Size 208KB
- Sample260819-cdnyysck71
- SHA256 5f4704c96c86d7f67300bed104cd497e11e65790fc6bf92518bf719823a0babc
- MD5 3dbabab0ddf4794d260f660b3a0a2b20
- SHA1 a8ef49a55303f9769494ac2e2845d3d76b5b7601
- SHA512 4c121a8617e5fdf79389fd75c070dc80faa7bdba4e916276cb815bc70e9ba35554ec5e36015f02cdb6453796fb9edb0b6e5ed202edd9ea24beeb0b50b1215370
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfH4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOfkEj1
- TLSH T1AA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1472 BTVOUR.exe 3476 QTSOF.exe 2440 YHEVQ.exe 5276 OMV.exe 472 FXU.exe 5084 SIC.exe 5988 PIMTBPX.exe 4360 QEQO.exe 5744 ABWJ.exe 6108 LULU.exe 4660 VSRONX.exe 4832 KISNU.exe 1920 MFXA.exe 5796 PBO.exe 1352 HWSFAKM.exe 1000 RTGZHS.exe 2868 ZHKGSR.exe 1076 WIUIE.exe 2108 ENZPO.exe 2120 YGOAY.exe 1620 KRZNH.exe 2020 BRNSTQB.exe 4808 JESZEO.exe 3700 GXCBI.exe 5832 DXME.exe 916 YIUCAZJ.exe 2268 LGU.exe 3116 NEIIR.exe 1336 FMOGEC.exe 1724 YEDRND.exe 3920 VFNBZ.exe 4072 OYVMJ.exe 5076 NIXU.exe 3668 TEJV.exe 2164 YETXJ.exe 1376 UKD.exe 2936 CPQ.exe 1068 QVQFMM.exe 1184 JNFQVN.exe 4132 IYIGE.exe 6092 CLZPXM.exe 4456 KZMWAK.exe 3952 PZOYL.exe 2064 OKYO.exe 4416 ZDGZ.exe 4876 MBGLFZV.exe 4260 WYTFV.exe 628 TEEUL.exe 1080 YEOXP.exe 5660 TNWLWB.exe 932 OXFK.exe 2980 ILKTU.exe 4900 YBLT.exe 1968 WZEOOEK.exe 2000 RMBX.exe 1048 KHMBEC.exe 4812 QCEC.exe 5952 SAR.exe 1900 XAZK.exe 4708 PJBPCFJ.exe 2432 YOL.exe 5536 JGGA.exe 4344 ZWHZHFC.exe 4996 TSMJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VDUW.exe.bat FILSQI.exe File created C:\windows\SysWOW64\NIXU.exe.bat OYVMJ.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe YBLT.exe File opened for modification C:\windows\SysWOW64\TTNR.exe LGN.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat XJEAYG.exe File created C:\windows\SysWOW64\AKVZLEM.exe.bat RCTTHH.exe File created C:\windows\SysWOW64\YGOAY.exe.bat ENZPO.exe File created C:\windows\SysWOW64\YEDRND.exe.bat FMOGEC.exe File created C:\windows\SysWOW64\UKD.exe YETXJ.exe File opened for modification C:\windows\SysWOW64\AKVZLEM.exe RCTTHH.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat SJS.exe File opened for modification C:\windows\SysWOW64\FAPH.exe EXZLSL.exe File opened for modification C:\windows\SysWOW64\HWSFAKM.exe PBO.exe File opened for modification C:\windows\SysWOW64\KZMWAK.exe CLZPXM.exe File opened for modification C:\windows\SysWOW64\OXFK.exe TNWLWB.exe File created C:\windows\SysWOW64\NFHODSF.exe.bat MKDSY.exe File created C:\windows\SysWOW64\OMV.exe.bat YHEVQ.exe File opened for modification C:\windows\SysWOW64\ZHKGSR.exe RTGZHS.exe File opened for modification C:\windows\SysWOW64\ZDGZ.exe OKYO.exe File created C:\windows\SysWOW64\ZDGZ.exe.bat OKYO.exe File created C:\windows\SysWOW64\SAR.exe.bat QCEC.exe File created C:\windows\SysWOW64\XAZK.exe.bat SAR.exe File created C:\windows\SysWOW64\YOL.exe PJBPCFJ.exe File created C:\windows\SysWOW64\YOL.exe.bat PJBPCFJ.exe File created C:\windows\SysWOW64\HWSFAKM.exe.bat PBO.exe File opened for modification C:\windows\SysWOW64\YEDRND.exe FMOGEC.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe QVQFMM.exe File opened for modification C:\windows\SysWOW64\JGGA.exe YOL.exe File created C:\windows\SysWOW64\LGN.exe SLJH.exe File opened for modification C:\windows\SysWOW64\LGN.exe SLJH.exe File created C:\windows\SysWOW64\MORVEA.exe TTNR.exe File created C:\windows\SysWOW64\MORVEA.exe.bat TTNR.exe File opened for modification C:\windows\SysWOW64\JESZEO.exe BRNSTQB.exe File created C:\windows\SysWOW64\LGU.exe.bat YIUCAZJ.exe File created C:\windows\SysWOW64\YEDRND.exe FMOGEC.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe YEDRND.exe File opened for modification C:\windows\SysWOW64\XAZK.exe SAR.exe File opened for modification C:\windows\SysWOW64\NFHODSF.exe MKDSY.exe File created C:\windows\SysWOW64\RCTTHH.exe XJEAYG.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe EVGCCN.exe File created C:\windows\SysWOW64\HWSFAKM.exe PBO.exe File created C:\windows\SysWOW64\ZHKGSR.exe.bat RTGZHS.exe File created C:\windows\SysWOW64\WYTFV.exe MBGLFZV.exe File created C:\windows\SysWOW64\OXFK.exe.bat TNWLWB.exe File created C:\windows\SysWOW64\RMBX.exe.bat WZEOOEK.exe File created C:\windows\SysWOW64\KWOQ.exe.bat EVGCCN.exe File created C:\windows\SysWOW64\YETXJ.exe.bat TEJV.exe File created C:\windows\SysWOW64\OXFK.exe TNWLWB.exe File created C:\windows\SysWOW64\SAR.exe QCEC.exe File created C:\windows\SysWOW64\XAZK.exe SAR.exe File opened for modification C:\windows\SysWOW64\MORVEA.exe TTNR.exe File opened for modification C:\windows\SysWOW64\LEESJDQ.exe SJS.exe File created C:\windows\SysWOW64\ZHKGSR.exe RTGZHS.exe File created C:\windows\SysWOW64\JESZEO.exe.bat BRNSTQB.exe File created C:\windows\SysWOW64\VFNBZ.exe YEDRND.exe File created C:\windows\SysWOW64\JNFQVN.exe.bat QVQFMM.exe File created C:\windows\SysWOW64\TTNR.exe LGN.exe File created C:\windows\SysWOW64\FMOGEC.exe.bat NEIIR.exe File opened for modification C:\windows\SysWOW64\NIXU.exe OYVMJ.exe File created C:\windows\SysWOW64\QVQFMM.exe CPQ.exe File created C:\windows\SysWOW64\WYTFV.exe.bat MBGLFZV.exe File created C:\windows\SysWOW64\JGGA.exe.bat YOL.exe File created C:\windows\SysWOW64\XJEAYG.exe.bat OJCV.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe XJEAYG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SIC.exe.bat FXU.exe File created C:\windows\ENZPO.exe.bat WIUIE.exe File opened for modification C:\windows\system\PZOYL.exe KZMWAK.exe File opened for modification C:\windows\system\KHMBEC.exe RMBX.exe File created C:\windows\system\VSRONX.exe.bat LULU.exe File created C:\windows\system\MFXA.exe KISNU.exe File opened for modification C:\windows\system\PBO.exe MFXA.exe File created C:\windows\system\GKW.exe MORVEA.exe File created C:\windows\ZWHZHFC.exe JGGA.exe File created C:\windows\SLJH.exe.bat INWNCZR.exe File opened for modification C:\windows\system\VSRONX.exe LULU.exe File created C:\windows\system\BNZU.exe AKVZLEM.exe File opened for modification C:\windows\system\GXCBI.exe JESZEO.exe File created C:\windows\DXME.exe.bat GXCBI.exe File created C:\windows\TEEUL.exe WYTFV.exe File created C:\windows\OJCV.exe.bat NGYAHL.exe File opened for modification C:\windows\EXZLSL.exe LEESJDQ.exe File opened for modification C:\windows\system\NEIIR.exe LGU.exe File created C:\windows\YEOXP.exe.bat TEEUL.exe File opened for modification C:\windows\system\ILKTU.exe OXFK.exe File created C:\windows\system\GKW.exe.bat MORVEA.exe File created C:\windows\MKDSY.exe.bat GKW.exe File created C:\windows\system\BNZU.exe.bat AKVZLEM.exe File created C:\windows\FXU.exe.bat OMV.exe File created C:\windows\system\NEIIR.exe.bat LGU.exe File created C:\windows\system\PJBPCFJ.exe.bat XAZK.exe File created C:\windows\NGYAHL.exe VDUW.exe File opened for modification C:\windows\system\SJS.exe KWOQ.exe File created C:\windows\system\CPQ.exe UKD.exe File created C:\windows\QCEC.exe.bat KHMBEC.exe File created C:\windows\IYIGE.exe.bat JNFQVN.exe File opened for modification C:\windows\system\CLZPXM.exe IYIGE.exe File opened for modification C:\windows\SLJH.exe INWNCZR.exe File opened for modification C:\windows\system\YHEVQ.exe QTSOF.exe File opened for modification C:\windows\WIUIE.exe ZHKGSR.exe File created C:\windows\system\KRZNH.exe.bat YGOAY.exe File opened for modification C:\windows\system\MBGLFZV.exe ZDGZ.exe File opened for modification C:\windows\TEEUL.exe WYTFV.exe File created C:\windows\TSMJ.exe.bat ZWHZHFC.exe File created C:\windows\INWNCZR.exe TSMJ.exe File created C:\windows\EVGCCN.exe.bat BNZU.exe File created C:\windows\system\SJS.exe KWOQ.exe File opened for modification C:\windows\PIMTBPX.exe SIC.exe File created C:\windows\QEQO.exe PIMTBPX.exe File opened for modification C:\windows\QEQO.exe PIMTBPX.exe File created C:\windows\system\ABWJ.exe QEQO.exe File created C:\windows\LULU.exe.bat ABWJ.exe File created C:\windows\system\PBO.exe.bat MFXA.exe File created C:\windows\system\NEIIR.exe LGU.exe File created C:\windows\NGYAHL.exe.bat VDUW.exe File created C:\windows\BTVOUR.exe 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe File created C:\windows\system\OYVMJ.exe.bat VFNBZ.exe File created C:\windows\TSMJ.exe ZWHZHFC.exe File opened for modification C:\windows\system\BNZU.exe AKVZLEM.exe File created C:\windows\KISNU.exe VSRONX.exe File opened for modification C:\windows\KISNU.exe VSRONX.exe File opened for modification C:\windows\IYIGE.exe JNFQVN.exe File created C:\windows\YEOXP.exe TEEUL.exe File opened for modification C:\windows\ZWHZHFC.exe JGGA.exe File created C:\windows\system\YHEVQ.exe.bat QTSOF.exe File created C:\windows\WIUIE.exe ZHKGSR.exe File opened for modification C:\windows\system\BRNSTQB.exe KRZNH.exe File opened for modification C:\windows\YIUCAZJ.exe DXME.exe File created C:\windows\system\OYVMJ.exe VFNBZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5360 cmd.exe 2512 cmd.exe 5752 cmd.exe 1328 cmd.exe 4824 cmd.exe 1536 cmd.exe 1480 cmd.exe 6080 cmd.exe 4108 cmd.exe 4052 cmd.exe 4852 cmd.exe 936 cmd.exe 968 cmd.exe 2604 cmd.exe 4056 cmd.exe 252 cmd.exe 1464 cmd.exe 2256 cmd.exe 3232 cmd.exe 3148 cmd.exe 4564 cmd.exe 4756 cmd.exe 5044 cmd.exe 5580 cmd.exe 6136 cmd.exe 4160 cmd.exe 5024 cmd.exe 5672 cmd.exe 4284 cmd.exe 3472 cmd.exe 3156 cmd.exe 2828 cmd.exe 4464 cmd.exe 3588 cmd.exe 4396 cmd.exe 1760 cmd.exe 364 cmd.exe 4680 cmd.exe 2488 cmd.exe 5496 cmd.exe 1916 cmd.exe 3096 cmd.exe 4676 cmd.exe 5296 cmd.exe 3380 cmd.exe 5228 cmd.exe 5416 cmd.exe 5916 cmd.exe 3824 cmd.exe 4920 cmd.exe 2248 cmd.exe 4928 cmd.exe 4652 cmd.exe 5876 cmd.exe 2008 cmd.exe 6064 cmd.exe 4692 cmd.exe 4720 cmd.exe 5948 cmd.exe 4736 cmd.exe 5792 cmd.exe 3608 cmd.exe 4172 cmd.exe 4724 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 976 4324 WerFault.exe 87 5100 1472 WerFault.exe 93 4876 3476 WerFault.exe 99 4184 2440 WerFault.exe 104 1500 5276 WerFault.exe 108 5032 472 WerFault.exe 114 3416 5084 WerFault.exe 119 5852 5988 WerFault.exe 124 2216 4360 WerFault.exe 129 1744 5744 WerFault.exe 134 4628 6108 WerFault.exe 139 936 4660 WerFault.exe 144 5040 4832 WerFault.exe 149 2152 1920 WerFault.exe 154 5624 5796 WerFault.exe 159 5880 1352 WerFault.exe 164 5488 1000 WerFault.exe 169 1192 2868 WerFault.exe 174 4280 1076 WerFault.exe 179 4456 2108 WerFault.exe 184 2172 2120 WerFault.exe 189 3392 1620 WerFault.exe 194 5300 2020 WerFault.exe 199 1924 4808 WerFault.exe 204 3404 3700 WerFault.exe 209 360 5832 WerFault.exe 214 1800 916 WerFault.exe 219 1216 2268 WerFault.exe 224 4384 3116 WerFault.exe 229 4192 1336 WerFault.exe 234 3620 1724 WerFault.exe 239 4724 3920 WerFault.exe 244 5720 4072 WerFault.exe 249 1744 5076 WerFault.exe 254 3056 3668 WerFault.exe 260 4364 2164 WerFault.exe 265 4200 1376 WerFault.exe 270 4544 2936 WerFault.exe 275 1528 1068 WerFault.exe 280 4316 1184 WerFault.exe 285 1124 4132 WerFault.exe 290 3444 6092 WerFault.exe 295 3648 4456 WerFault.exe 300 4776 3952 WerFault.exe 305 4860 2064 WerFault.exe 310 4820 4416 WerFault.exe 315 2396 4876 WerFault.exe 320 2876 4260 WerFault.exe 325 4188 628 WerFault.exe 330 1964 1080 WerFault.exe 335 5580 5660 WerFault.exe 340 3824 932 WerFault.exe 345 3524 2980 WerFault.exe 350 1232 4900 WerFault.exe 355 1668 1968 WerFault.exe 360 3572 2000 WerFault.exe 365 4160 1048 WerFault.exe 370 3504 4812 WerFault.exe 375 5936 5952 WerFault.exe 380 1280 1900 WerFault.exe 385 1292 4708 WerFault.exe 390 4296 2432 WerFault.exe 395 4628 5536 WerFault.exe 400 2812 4344 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTVOUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PZOYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVGCCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWLWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFHODSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFNBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMOGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHZHFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKDSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTSOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIMTBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRNSTQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKYO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGYAHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRZNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZMWAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJBPCFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe 4324 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe 1472 BTVOUR.exe 1472 BTVOUR.exe 3476 QTSOF.exe 3476 QTSOF.exe 2440 YHEVQ.exe 2440 YHEVQ.exe 5276 OMV.exe 5276 OMV.exe 472 FXU.exe 472 FXU.exe 5084 SIC.exe 5084 SIC.exe 5988 PIMTBPX.exe 5988 PIMTBPX.exe 4360 QEQO.exe 4360 QEQO.exe 5744 ABWJ.exe 5744 ABWJ.exe 6108 LULU.exe 6108 LULU.exe 4660 VSRONX.exe 4660 VSRONX.exe 4832 KISNU.exe 4832 KISNU.exe 1920 MFXA.exe 1920 MFXA.exe 5796 PBO.exe 5796 PBO.exe 1352 HWSFAKM.exe 1352 HWSFAKM.exe 1000 RTGZHS.exe 1000 RTGZHS.exe 2868 ZHKGSR.exe 2868 ZHKGSR.exe 1076 WIUIE.exe 1076 WIUIE.exe 2108 ENZPO.exe 2108 ENZPO.exe 2120 YGOAY.exe 2120 YGOAY.exe 1620 KRZNH.exe 1620 KRZNH.exe 2020 BRNSTQB.exe 2020 BRNSTQB.exe 4808 JESZEO.exe 4808 JESZEO.exe 3700 GXCBI.exe 3700 GXCBI.exe 5832 DXME.exe 5832 DXME.exe 916 YIUCAZJ.exe 916 YIUCAZJ.exe 2268 LGU.exe 2268 LGU.exe 3116 NEIIR.exe 3116 NEIIR.exe 1336 FMOGEC.exe 1336 FMOGEC.exe 1724 YEDRND.exe 1724 YEDRND.exe 3920 VFNBZ.exe 3920 VFNBZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4324 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe 4324 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe 1472 BTVOUR.exe 1472 BTVOUR.exe 3476 QTSOF.exe 3476 QTSOF.exe 2440 YHEVQ.exe 2440 YHEVQ.exe 5276 OMV.exe 5276 OMV.exe 472 FXU.exe 472 FXU.exe 5084 SIC.exe 5084 SIC.exe 5988 PIMTBPX.exe 5988 PIMTBPX.exe 4360 QEQO.exe 4360 QEQO.exe 5744 ABWJ.exe 5744 ABWJ.exe 6108 LULU.exe 6108 LULU.exe 4660 VSRONX.exe 4660 VSRONX.exe 4832 KISNU.exe 4832 KISNU.exe 1920 MFXA.exe 1920 MFXA.exe 5796 PBO.exe 5796 PBO.exe 1352 HWSFAKM.exe 1352 HWSFAKM.exe 1000 RTGZHS.exe 1000 RTGZHS.exe 2868 ZHKGSR.exe 2868 ZHKGSR.exe 1076 WIUIE.exe 1076 WIUIE.exe 2108 ENZPO.exe 2108 ENZPO.exe 2120 YGOAY.exe 2120 YGOAY.exe 1620 KRZNH.exe 1620 KRZNH.exe 2020 BRNSTQB.exe 2020 BRNSTQB.exe 4808 JESZEO.exe 4808 JESZEO.exe 3700 GXCBI.exe 3700 GXCBI.exe 5832 DXME.exe 5832 DXME.exe 916 YIUCAZJ.exe 916 YIUCAZJ.exe 2268 LGU.exe 2268 LGU.exe 3116 NEIIR.exe 3116 NEIIR.exe 1336 FMOGEC.exe 1336 FMOGEC.exe 1724 YEDRND.exe 1724 YEDRND.exe 3920 VFNBZ.exe 3920 VFNBZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4692 4324 2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe 89 PID 4692 wrote to memory of 1472 4692 cmd.exe 93 PID 1472 wrote to memory of 1548 1472 BTVOUR.exe 95 PID 1548 wrote to memory of 3476 1548 cmd.exe 99 PID 3476 wrote to memory of 2724 3476 QTSOF.exe 100 PID 2724 wrote to memory of 2440 2724 cmd.exe 104 PID 2440 wrote to memory of 4564 2440 YHEVQ.exe 105 PID 4564 wrote to memory of 5276 4564 cmd.exe 108 PID 5276 wrote to memory of 5784 5276 OMV.exe 110 PID 5784 wrote to memory of 472 5784 cmd.exe 114 PID 472 wrote to memory of 4056 472 FXU.exe 115 PID 4056 wrote to memory of 5084 4056 cmd.exe 119 PID 5084 wrote to memory of 5636 5084 SIC.exe 120 PID 5636 wrote to memory of 5988 5636 cmd.exe 124 PID 5988 wrote to memory of 4720 5988 PIMTBPX.exe 125 PID 4720 wrote to memory of 4360 4720 cmd.exe 129 PID 4360 wrote to memory of 4592 4360 QEQO.exe 130 PID 4592 wrote to memory of 5744 4592 cmd.exe 134 PID 5744 wrote to memory of 6080 5744 ABWJ.exe 135 PID 6080 wrote to memory of 6108 6080 cmd.exe 139 PID 6108 wrote to memory of 3588 6108 LULU.exe 140 PID 3588 wrote to memory of 4660 3588 cmd.exe 144 PID 4660 wrote to memory of 4108 4660 VSRONX.exe 145 PID 4108 wrote to memory of 4832 4108 cmd.exe 149 PID 4832 wrote to memory of 4444 4832 KISNU.exe 150 PID 4444 wrote to memory of 1920 4444 cmd.exe 154 PID 1920 wrote to memory of 4052 1920 MFXA.exe 155 PID 4052 wrote to memory of 5796 4052 cmd.exe 159 PID 5796 wrote to memory of 4396 5796 PBO.exe 160 PID 4396 wrote to memory of 1352 4396 cmd.exe 164 PID 1352 wrote to memory of 3944 1352 HWSFAKM.exe 165 PID 3944 wrote to memory of 1000 3944 cmd.exe 169 PID 1000 wrote to memory of 2816 1000 RTGZHS.exe 170 PID 2816 wrote to memory of 2868 2816 cmd.exe 174 PID 2868 wrote to memory of 3048 2868 ZHKGSR.exe 175 PID 3048 wrote to memory of 1076 3048 cmd.exe 179 PID 1076 wrote to memory of 3276 1076 WIUIE.exe 180 PID 3276 wrote to memory of 2108 3276 cmd.exe 184 PID 2108 wrote to memory of 1916 2108 ENZPO.exe 185 PID 1916 wrote to memory of 2120 1916 cmd.exe 189 PID 2120 wrote to memory of 3608 2120 YGOAY.exe 190 PID 3608 wrote to memory of 1620 3608 cmd.exe 194 PID 1620 wrote to memory of 2192 1620 KRZNH.exe 195 PID 2192 wrote to memory of 2020 2192 cmd.exe 199 PID 2020 wrote to memory of 5176 2020 BRNSTQB.exe 200 PID 5176 wrote to memory of 4808 5176 cmd.exe 204 PID 4808 wrote to memory of 5040 4808 JESZEO.exe 205 PID 5040 wrote to memory of 3700 5040 cmd.exe 209 PID 3700 wrote to memory of 4928 3700 GXCBI.exe 210 PID 4928 wrote to memory of 5832 4928 cmd.exe 214 PID 5832 wrote to memory of 252 5832 DXME.exe 215 PID 252 wrote to memory of 916 252 cmd.exe 219 PID 916 wrote to memory of 1328 916 YIUCAZJ.exe 220 PID 1328 wrote to memory of 2268 1328 cmd.exe 224 PID 2268 wrote to memory of 5032 2268 LGU.exe 225 PID 5032 wrote to memory of 3116 5032 cmd.exe 229 PID 3116 wrote to memory of 4716 3116 NEIIR.exe 230 PID 4716 wrote to memory of 1336 4716 cmd.exe 234 PID 1336 wrote to memory of 4752 1336 FMOGEC.exe 235 PID 4752 wrote to memory of 1724 4752 cmd.exe 239 PID 1724 wrote to memory of 4280 1724 YEDRND.exe 240 PID 4280 wrote to memory of 3920 4280 cmd.exe 244 PID 3920 wrote to memory of 2216 3920 VFNBZ.exe 245 PID 2216 wrote to memory of 4072 2216 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3dbabab0ddf4794d260f660b3a0a2b20_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BTVOUR.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\BTVOUR.exeC:\windows\BTVOUR.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTSOF.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\QTSOF.exeC:\windows\QTSOF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHEVQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\system\YHEVQ.exeC:\windows\system\YHEVQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMV.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\SysWOW64\OMV.exeC:\windows\system32\OMV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXU.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\FXU.exeC:\windows\FXU.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIC.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\SIC.exeC:\windows\SIC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIMTBPX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\PIMTBPX.exeC:\windows\PIMTBPX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEQO.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\QEQO.exeC:\windows\QEQO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABWJ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\system\ABWJ.exeC:\windows\system\ABWJ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULU.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\LULU.exeC:\windows\LULU.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSRONX.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\system\VSRONX.exeC:\windows\system\VSRONX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KISNU.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\KISNU.exeC:\windows\KISNU.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFXA.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\system\MFXA.exeC:\windows\system\MFXA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBO.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\windows\system\PBO.exeC:\windows\system\PBO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSFAKM.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\HWSFAKM.exeC:\windows\system32\HWSFAKM.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTGZHS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\RTGZHS.exeC:\windows\RTGZHS.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHKGSR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\SysWOW64\ZHKGSR.exeC:\windows\system32\ZHKGSR.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIUIE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\WIUIE.exeC:\windows\WIUIE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENZPO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\ENZPO.exeC:\windows\ENZPO.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KRZNH.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\windows\system\KRZNH.exeC:\windows\system\KRZNH.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\JESZEO.exeC:\windows\system32\JESZEO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXME.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\DXME.exeC:\windows\DXME.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YIUCAZJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\YIUCAZJ.exeC:\windows\YIUCAZJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEIIR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\NEIIR.exeC:\windows\system\NEIIR.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOGEC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\SysWOW64\FMOGEC.exeC:\windows\system32\FMOGEC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEDRND.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\SysWOW64\YEDRND.exeC:\windows\system32\YEDRND.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYVMJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\system\OYVMJ.exeC:\windows\system\OYVMJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIXU.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\SysWOW64\NIXU.exeC:\windows\system32\NIXU.exe67⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEJV.exe.bat" "68⤵PID:3712
-
C:\windows\system\TEJV.exeC:\windows\system\TEJV.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YETXJ.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\windows\SysWOW64\YETXJ.exeC:\windows\system32\YETXJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5044 -
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3096 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4172 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1760 -
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4704 -
C:\windows\IYIGE.exeC:\windows\IYIGE.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "82⤵PID:5104
-
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "84⤵PID:2040
-
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PZOYL.exe.bat" "86⤵PID:832
-
C:\windows\system\PZOYL.exeC:\windows\system\PZOYL.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5792 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4412 -
C:\windows\YEOXP.exeC:\windows\YEOXP.exe99⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "100⤵PID:5440
-
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4652 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe105⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "106⤵PID:3888
-
C:\windows\YBLT.exeC:\windows\YBLT.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "108⤵PID:3360
-
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "110⤵PID:3336
-
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHMBEC.exe.bat" "112⤵
- Executes a command shell one-liner
PID:364 -
C:\windows\system\KHMBEC.exeC:\windows\system\KHMBEC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4144 -
C:\windows\QCEC.exeC:\windows\QCEC.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAR.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4676 -
C:\windows\SysWOW64\SAR.exeC:\windows\system32\SAR.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAZK.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1464 -
C:\windows\SysWOW64\XAZK.exeC:\windows\system32\XAZK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:444 -
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-