Analysis
- max time kernel
71s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe
- Size 208KB
- Sample260820-1g4qksbj21
- SHA256 7930848b701300e1448b285bd62c8a040d7fad4b80c6e4091d7c7757111819e2
- MD5 8e21680c1d5e139db75f6809c7a26c70
- SHA1 d2d28857d6e9525447912af9c4060861ffc45614
- SHA512 a57834be7cf4e9d6b2c9cd13248df82d433e1a791faef7894a0c375cc4c1a83cc9d791693bcc6632ad9560135c06236d6f7fc655871241300720f02822a2aae7
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8l9dL+LOf44pLthEjQT6j:vlZtbLWIgd1LZ9oECZb8l95+LOwkEj1
- TLSH T197247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 824 LXUFKVO.exe 1816 TSQHC.exe 5220 VQE.exe 5724 ZQGE.exe 3340 WRQ.exe 4884 PJX.exe 2484 RHLMYJ.exe 4560 LASXIK.exe 5320 RVEQO.exe 1596 UDNMVTC.exe 1852 LMTKHKX.exe 5520 IED.exe 4548 QSP.exe 1244 APVVL.exe 5732 UDMWXG.exe 2276 XLVTEAV.exe 2492 WEYBMG.exe 1696 PWFM.exe 3180 XCSB.exe 1868 ZZY.exe 4124 JXL.exe 3160 ZNMH.exe 4360 MYVX.exe 1156 BOWXX.exe 5568 URZS.exe 4264 YXS.exe 5392 MUSTCN.exe 4864 ZFISQY.exe 1092 JDOM.exe 1768 CYR.exe 2472 PEZUNI.exe 3216 HEGZAZ.exe 2336 YMI.exe 1928 RFX.exe 2556 IQAFVDI.exe 5864 MVSUM.exe 5544 HQXEWGZ.exe 5580 EJZ.exe 940 VRBL.exe 1232 IURKRKX.exe 1540 DPWT.exe 4580 LVBA.exe 2316 LBBOO.exe 2952 OWSYH.exe 5728 OBKMJU.exe 1304 DWUR.exe 4628 DZG.exe 1292 YNCE.exe 4324 NDMVQS.exe 4732 DYVA.exe 4416 HJGNKR.exe 1912 HMJR.exe 4128 AHNMDF.exe 4816 BKR.exe 5680 ZAKL.exe 1072 DLIGD.exe 3540 CAUJQ.exe 4552 NTXU.exe 5324 VHBI.exe 4164 QUGSTE.exe 4960 DSOEVQ.exe 2624 UFQWLMW.exe 4748 TQBMUA.exe 4644 CYDRXYU.exe - Drops file in System32 directory 60 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MUSTCN.exe YXS.exe File created C:\windows\SysWOW64\JRDI.exe.bat PEY.exe File opened for modification C:\windows\SysWOW64\DBCMJW.exe MTAHF.exe File created C:\windows\SysWOW64\HEGZAZ.exe PEZUNI.exe File opened for modification C:\windows\SysWOW64\HMJR.exe HJGNKR.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe LASXIK.exe File created C:\windows\SysWOW64\DWUR.exe OBKMJU.exe File created C:\windows\SysWOW64\YNCE.exe.bat DZG.exe File created C:\windows\SysWOW64\NFINAR.exe.bat WWGIW.exe File created C:\windows\SysWOW64\BLC.exe.bat MVTQN.exe File opened for modification C:\windows\SysWOW64\JRDI.exe PEY.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat PEZUNI.exe File created C:\windows\SysWOW64\MVSUM.exe IQAFVDI.exe File created C:\windows\SysWOW64\DBCMJW.exe MTAHF.exe File created C:\windows\SysWOW64\IURKRKX.exe VRBL.exe File opened for modification C:\windows\SysWOW64\DZG.exe DWUR.exe File created C:\windows\SysWOW64\HMJR.exe HJGNKR.exe File created C:\windows\SysWOW64\CYDRXYU.exe TQBMUA.exe File created C:\windows\SysWOW64\KVUNY.exe EVMZP.exe File created C:\windows\SysWOW64\KVUNY.exe.bat EVMZP.exe File opened for modification C:\windows\SysWOW64\WWGIW.exe DBCMJW.exe File created C:\windows\SysWOW64\BLC.exe MVTQN.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat UDMWXG.exe File created C:\windows\SysWOW64\MYVX.exe.bat ZNMH.exe File created C:\windows\SysWOW64\JRDI.exe PEY.exe File created C:\windows\SysWOW64\DBCMJW.exe.bat MTAHF.exe File opened for modification C:\windows\SysWOW64\NFINAR.exe WWGIW.exe File created C:\windows\SysWOW64\MVTQN.exe NFINAR.exe File created C:\windows\SysWOW64\RVEQO.exe LASXIK.exe File opened for modification C:\windows\SysWOW64\MVSUM.exe IQAFVDI.exe File created C:\windows\SysWOW64\DWUR.exe.bat OBKMJU.exe File created C:\windows\SysWOW64\DZG.exe.bat DWUR.exe File created C:\windows\SysWOW64\NDMVQS.exe.bat YNCE.exe File created C:\windows\SysWOW64\HMJR.exe.bat HJGNKR.exe File created C:\windows\SysWOW64\WWGIW.exe.bat DBCMJW.exe File created C:\windows\SysWOW64\RVEQO.exe.bat LASXIK.exe File opened for modification C:\windows\SysWOW64\MYVX.exe ZNMH.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat YXS.exe File created C:\windows\SysWOW64\MVSUM.exe.bat IQAFVDI.exe File created C:\windows\SysWOW64\IURKRKX.exe.bat VRBL.exe File created C:\windows\SysWOW64\YNCE.exe DZG.exe File created C:\windows\SysWOW64\NDMVQS.exe YNCE.exe File created C:\windows\SysWOW64\MVTQN.exe.bat NFINAR.exe File opened for modification C:\windows\SysWOW64\XLVTEAV.exe UDMWXG.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe PEZUNI.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe TQBMUA.exe File created C:\windows\SysWOW64\NFINAR.exe WWGIW.exe File created C:\windows\SysWOW64\XLVTEAV.exe UDMWXG.exe File opened for modification C:\windows\SysWOW64\NDMVQS.exe YNCE.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe EVMZP.exe File created C:\windows\SysWOW64\WWGIW.exe DBCMJW.exe File created C:\windows\SysWOW64\DZG.exe DWUR.exe File created C:\windows\SysWOW64\CYDRXYU.exe.bat TQBMUA.exe File opened for modification C:\windows\SysWOW64\BLC.exe MVTQN.exe File opened for modification C:\windows\SysWOW64\YNCE.exe DZG.exe File opened for modification C:\windows\SysWOW64\IURKRKX.exe VRBL.exe File created C:\windows\SysWOW64\MYVX.exe ZNMH.exe File opened for modification C:\windows\SysWOW64\MVTQN.exe NFINAR.exe File opened for modification C:\windows\SysWOW64\DWUR.exe OBKMJU.exe File created C:\windows\SysWOW64\MUSTCN.exe YXS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EVMZP.exe.bat UXZFZ.exe File created C:\windows\system\PJX.exe.bat WRQ.exe File opened for modification C:\windows\system\RFX.exe YMI.exe File opened for modification C:\windows\EJZ.exe HQXEWGZ.exe File opened for modification C:\windows\system\LXUFKVO.exe 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe File created C:\windows\YXS.exe URZS.exe File created C:\windows\EJZ.exe.bat HQXEWGZ.exe File created C:\windows\system\OBKMJU.exe OWSYH.exe File created C:\windows\system\VPIPJ.exe.bat LRUUBY.exe File opened for modification C:\windows\TSQHC.exe LXUFKVO.exe File opened for modification C:\windows\UDMWXG.exe APVVL.exe File created C:\windows\YXS.exe.bat URZS.exe File created C:\windows\ZFISQY.exe MUSTCN.exe File created C:\windows\system\YMI.exe HEGZAZ.exe File created C:\windows\DPWT.exe.bat IURKRKX.exe File opened for modification C:\windows\LBBOO.exe LVBA.exe File opened for modification C:\windows\HJGNKR.exe DYVA.exe File created C:\windows\VQE.exe TSQHC.exe File created C:\windows\system\LMTKHKX.exe UDNMVTC.exe File created C:\windows\system\CYR.exe JDOM.exe File created C:\windows\DPWT.exe IURKRKX.exe File created C:\windows\ZAKL.exe.bat BKR.exe File created C:\windows\JTPAMQ.exe.bat DTHMDO.exe File created C:\windows\system\VPIPJ.exe LRUUBY.exe File opened for modification C:\windows\system\VRBL.exe EJZ.exe File created C:\windows\DLIGD.exe.bat ZAKL.exe File created C:\windows\VHBI.exe.bat NTXU.exe File opened for modification C:\windows\system\VPIPJ.exe LRUUBY.exe File created C:\windows\system\YWMTLSR.exe.bat WYZZD.exe File created C:\windows\system\XCSB.exe PWFM.exe File created C:\windows\system\LXUFKVO.exe 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe File created C:\windows\TSQHC.exe LXUFKVO.exe File created C:\windows\system\YMI.exe.bat HEGZAZ.exe File created C:\windows\system\RFX.exe.bat YMI.exe File opened for modification C:\windows\system\HQXEWGZ.exe MVSUM.exe File created C:\windows\system\LVBA.exe DPWT.exe File opened for modification C:\windows\system\QPS.exe ICO.exe File created C:\windows\IQAFVDI.exe.bat RFX.exe File opened for modification C:\windows\DLIGD.exe ZAKL.exe File created C:\windows\system\LMTKHKX.exe.bat UDNMVTC.exe File opened for modification C:\windows\ZNMH.exe JXL.exe File opened for modification C:\windows\BOWXX.exe MYVX.exe File opened for modification C:\windows\YXS.exe URZS.exe File created C:\windows\IQAFVDI.exe RFX.exe File created C:\windows\ZAKL.exe BKR.exe File opened for modification C:\windows\VHBI.exe NTXU.exe File created C:\windows\WBUV.exe HLTVFYY.exe File opened for modification C:\windows\PWFM.exe WEYBMG.exe File created C:\windows\BOWXX.exe.bat MYVX.exe File created C:\windows\system\PEZUNI.exe CYR.exe File opened for modification C:\windows\IQAFVDI.exe RFX.exe File opened for modification C:\windows\IVIB.exe VPIPJ.exe File created C:\windows\system\HLTVFYY.exe IVIB.exe File opened for modification C:\windows\system\LASXIK.exe RHLMYJ.exe File created C:\windows\ZQGE.exe.bat VQE.exe File opened for modification C:\windows\VQE.exe TSQHC.exe File opened for modification C:\windows\system\LMTKHKX.exe UDNMVTC.exe File created C:\windows\JDOM.exe.bat ZFISQY.exe File opened for modification C:\windows\UFQWLMW.exe DSOEVQ.exe File opened for modification C:\windows\system\ICO.exe JRDI.exe File created C:\windows\system\WRQ.exe ZQGE.exe File created C:\windows\system\UDNMVTC.exe RVEQO.exe File created C:\windows\system\HQXEWGZ.exe.bat MVSUM.exe File created C:\windows\system\WYZZD.exe BLC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1068 cmd.exe 5848 cmd.exe 2596 cmd.exe 4620 cmd.exe 3460 cmd.exe 5684 cmd.exe 4476 cmd.exe 3780 cmd.exe 5224 cmd.exe 2760 cmd.exe 2824 cmd.exe 5508 cmd.exe 3976 cmd.exe 3004 cmd.exe 3852 cmd.exe 4876 cmd.exe 5808 cmd.exe 3120 cmd.exe 1220 cmd.exe 4496 cmd.exe 3436 cmd.exe 1836 cmd.exe 2700 cmd.exe 5156 cmd.exe 2272 cmd.exe 5052 cmd.exe 6044 cmd.exe 2972 cmd.exe 1176 cmd.exe 2764 cmd.exe 3244 cmd.exe 4728 cmd.exe 120 cmd.exe 2508 cmd.exe 2748 cmd.exe 6132 cmd.exe 1308 cmd.exe 2868 cmd.exe 2416 cmd.exe 3376 cmd.exe 4612 cmd.exe 5956 cmd.exe 5504 cmd.exe 3880 cmd.exe 252 cmd.exe 5704 cmd.exe 3320 cmd.exe 2488 cmd.exe 1132 cmd.exe 1284 cmd.exe 4380 cmd.exe 948 cmd.exe 4304 cmd.exe 620 cmd.exe 5020 cmd.exe 4696 cmd.exe 1340 cmd.exe 1236 cmd.exe 4492 cmd.exe 3412 cmd.exe 4868 cmd.exe 2420 cmd.exe 6060 cmd.exe 4288 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4848 4140 WerFault.exe 87 3304 824 WerFault.exe 93 4492 1816 WerFault.exe 99 4168 5220 WerFault.exe 104 468 5724 WerFault.exe 109 4264 3340 WerFault.exe 114 3860 4884 WerFault.exe 119 4156 2484 WerFault.exe 124 4988 4560 WerFault.exe 129 4676 5320 WerFault.exe 134 5008 1596 WerFault.exe 139 5836 1852 WerFault.exe 144 5692 5520 WerFault.exe 149 2624 4548 WerFault.exe 154 3096 1244 WerFault.exe 159 3052 5732 WerFault.exe 164 4728 2276 WerFault.exe 169 3760 2492 WerFault.exe 174 5896 1696 WerFault.exe 179 5164 3180 WerFault.exe 184 4412 1868 WerFault.exe 189 3876 4124 WerFault.exe 194 1248 3160 WerFault.exe 199 4128 4360 WerFault.exe 204 5484 1156 WerFault.exe 209 2724 5568 WerFault.exe 214 1288 4264 WerFault.exe 219 200 5392 WerFault.exe 224 3880 4864 WerFault.exe 229 1420 1092 WerFault.exe 234 6120 1768 WerFault.exe 239 960 2472 WerFault.exe 244 5060 3216 WerFault.exe 249 2360 2336 WerFault.exe 254 5372 1928 WerFault.exe 259 1304 2556 WerFault.exe 265 4728 5864 WerFault.exe 270 1292 5544 WerFault.exe 275 2376 5580 WerFault.exe 280 4732 940 WerFault.exe 285 1416 1232 WerFault.exe 290 960 1540 WerFault.exe 295 2700 4580 WerFault.exe 300 1116 2316 WerFault.exe 305 4260 2952 WerFault.exe 310 2672 5728 WerFault.exe 315 4596 1304 WerFault.exe 320 2500 4628 WerFault.exe 325 2376 1292 WerFault.exe 330 5008 4324 WerFault.exe 335 3244 4732 WerFault.exe 340 4256 4416 WerFault.exe 345 2700 1912 WerFault.exe 350 5988 4128 WerFault.exe 355 352 4816 WerFault.exe 360 6060 5680 WerFault.exe 365 1064 1072 WerFault.exe 370 1264 3540 WerFault.exe 375 4996 4552 WerFault.exe 380 2788 5324 WerFault.exe 385 2896 4164 WerFault.exe 390 2140 4960 WerFault.exe 394 4192 2624 WerFault.exe 400 5404 4748 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEYBMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFISQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEZUNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQAFVDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSQHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMTKHKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXUFKVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLIGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJGNKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLTVFYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LASXIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVSUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAUJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQBMUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQXEWGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRUUBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYDRXYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTAHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IURKRKX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe 4140 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe 824 LXUFKVO.exe 824 LXUFKVO.exe 1816 TSQHC.exe 1816 TSQHC.exe 5220 VQE.exe 5220 VQE.exe 5724 ZQGE.exe 5724 ZQGE.exe 3340 WRQ.exe 3340 WRQ.exe 4884 PJX.exe 4884 PJX.exe 2484 RHLMYJ.exe 2484 RHLMYJ.exe 4560 LASXIK.exe 4560 LASXIK.exe 5320 RVEQO.exe 5320 RVEQO.exe 1596 UDNMVTC.exe 1596 UDNMVTC.exe 1852 LMTKHKX.exe 1852 LMTKHKX.exe 5520 IED.exe 5520 IED.exe 4548 QSP.exe 4548 QSP.exe 1244 APVVL.exe 1244 APVVL.exe 5732 UDMWXG.exe 5732 UDMWXG.exe 2276 XLVTEAV.exe 2276 XLVTEAV.exe 2492 WEYBMG.exe 2492 WEYBMG.exe 1696 PWFM.exe 1696 PWFM.exe 3180 XCSB.exe 3180 XCSB.exe 1868 ZZY.exe 1868 ZZY.exe 4124 JXL.exe 4124 JXL.exe 3160 ZNMH.exe 3160 ZNMH.exe 4360 MYVX.exe 4360 MYVX.exe 1156 BOWXX.exe 1156 BOWXX.exe 5568 URZS.exe 5568 URZS.exe 4264 YXS.exe 4264 YXS.exe 5392 MUSTCN.exe 5392 MUSTCN.exe 4864 ZFISQY.exe 4864 ZFISQY.exe 1092 JDOM.exe 1092 JDOM.exe 1768 CYR.exe 1768 CYR.exe 2472 PEZUNI.exe 2472 PEZUNI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4140 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe 4140 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe 824 LXUFKVO.exe 824 LXUFKVO.exe 1816 TSQHC.exe 1816 TSQHC.exe 5220 VQE.exe 5220 VQE.exe 5724 ZQGE.exe 5724 ZQGE.exe 3340 WRQ.exe 3340 WRQ.exe 4884 PJX.exe 4884 PJX.exe 2484 RHLMYJ.exe 2484 RHLMYJ.exe 4560 LASXIK.exe 4560 LASXIK.exe 5320 RVEQO.exe 5320 RVEQO.exe 1596 UDNMVTC.exe 1596 UDNMVTC.exe 1852 LMTKHKX.exe 1852 LMTKHKX.exe 5520 IED.exe 5520 IED.exe 4548 QSP.exe 4548 QSP.exe 1244 APVVL.exe 1244 APVVL.exe 5732 UDMWXG.exe 5732 UDMWXG.exe 2276 XLVTEAV.exe 2276 XLVTEAV.exe 2492 WEYBMG.exe 2492 WEYBMG.exe 1696 PWFM.exe 1696 PWFM.exe 3180 XCSB.exe 3180 XCSB.exe 1868 ZZY.exe 1868 ZZY.exe 4124 JXL.exe 4124 JXL.exe 3160 ZNMH.exe 3160 ZNMH.exe 4360 MYVX.exe 4360 MYVX.exe 1156 BOWXX.exe 1156 BOWXX.exe 5568 URZS.exe 5568 URZS.exe 4264 YXS.exe 4264 YXS.exe 5392 MUSTCN.exe 5392 MUSTCN.exe 4864 ZFISQY.exe 4864 ZFISQY.exe 1092 JDOM.exe 1092 JDOM.exe 1768 CYR.exe 1768 CYR.exe 2472 PEZUNI.exe 2472 PEZUNI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 5844 4140 2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe 89 PID 5844 wrote to memory of 824 5844 cmd.exe 93 PID 824 wrote to memory of 1132 824 LXUFKVO.exe 95 PID 1132 wrote to memory of 1816 1132 cmd.exe 99 PID 1816 wrote to memory of 3764 1816 TSQHC.exe 100 PID 3764 wrote to memory of 5220 3764 cmd.exe 104 PID 5220 wrote to memory of 4972 5220 VQE.exe 105 PID 4972 wrote to memory of 5724 4972 cmd.exe 109 PID 5724 wrote to memory of 4612 5724 ZQGE.exe 110 PID 4612 wrote to memory of 3340 4612 cmd.exe 114 PID 3340 wrote to memory of 4800 3340 WRQ.exe 115 PID 4800 wrote to memory of 4884 4800 cmd.exe 119 PID 4884 wrote to memory of 5808 4884 PJX.exe 120 PID 5808 wrote to memory of 2484 5808 cmd.exe 124 PID 2484 wrote to memory of 4268 2484 RHLMYJ.exe 125 PID 4268 wrote to memory of 4560 4268 cmd.exe 129 PID 4560 wrote to memory of 6052 4560 LASXIK.exe 130 PID 6052 wrote to memory of 5320 6052 cmd.exe 134 PID 5320 wrote to memory of 1284 5320 RVEQO.exe 135 PID 1284 wrote to memory of 1596 1284 cmd.exe 139 PID 1596 wrote to memory of 4428 1596 UDNMVTC.exe 140 PID 4428 wrote to memory of 1852 4428 cmd.exe 144 PID 1852 wrote to memory of 4592 1852 LMTKHKX.exe 145 PID 4592 wrote to memory of 5520 4592 cmd.exe 149 PID 5520 wrote to memory of 2828 5520 IED.exe 150 PID 2828 wrote to memory of 4548 2828 cmd.exe 154 PID 4548 wrote to memory of 3120 4548 QSP.exe 155 PID 3120 wrote to memory of 1244 3120 cmd.exe 159 PID 1244 wrote to memory of 720 1244 APVVL.exe 160 PID 720 wrote to memory of 5732 720 cmd.exe 164 PID 5732 wrote to memory of 3976 5732 UDMWXG.exe 165 PID 3976 wrote to memory of 2276 3976 cmd.exe 169 PID 2276 wrote to memory of 1600 2276 XLVTEAV.exe 170 PID 1600 wrote to memory of 2492 1600 cmd.exe 174 PID 2492 wrote to memory of 3400 2492 WEYBMG.exe 175 PID 3400 wrote to memory of 1696 3400 cmd.exe 179 PID 1696 wrote to memory of 3780 1696 PWFM.exe 180 PID 3780 wrote to memory of 3180 3780 cmd.exe 184 PID 3180 wrote to memory of 1220 3180 XCSB.exe 185 PID 1220 wrote to memory of 1868 1220 cmd.exe 189 PID 1868 wrote to memory of 2300 1868 ZZY.exe 190 PID 2300 wrote to memory of 4124 2300 cmd.exe 194 PID 4124 wrote to memory of 5184 4124 JXL.exe 195 PID 5184 wrote to memory of 3160 5184 cmd.exe 199 PID 3160 wrote to memory of 2636 3160 ZNMH.exe 200 PID 2636 wrote to memory of 4360 2636 cmd.exe 204 PID 4360 wrote to memory of 5692 4360 MYVX.exe 205 PID 5692 wrote to memory of 1156 5692 cmd.exe 209 PID 1156 wrote to memory of 5532 1156 BOWXX.exe 210 PID 5532 wrote to memory of 5568 5532 cmd.exe 214 PID 5568 wrote to memory of 4380 5568 URZS.exe 215 PID 4380 wrote to memory of 4264 4380 cmd.exe 219 PID 4264 wrote to memory of 1068 4264 YXS.exe 220 PID 1068 wrote to memory of 5392 1068 cmd.exe 224 PID 5392 wrote to memory of 1960 5392 MUSTCN.exe 225 PID 1960 wrote to memory of 4864 1960 cmd.exe 229 PID 4864 wrote to memory of 5848 4864 ZFISQY.exe 230 PID 5848 wrote to memory of 1092 5848 cmd.exe 234 PID 1092 wrote to memory of 4696 1092 JDOM.exe 235 PID 4696 wrote to memory of 1768 4696 cmd.exe 239 PID 1768 wrote to memory of 936 1768 CYR.exe 240 PID 936 wrote to memory of 2472 936 cmd.exe 244 PID 2472 wrote to memory of 4412 2472 PEZUNI.exe 245 PID 4412 wrote to memory of 3216 4412 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8e21680c1d5e139db75f6809c7a26c70_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\VQE.exeC:\windows\VQE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRQ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\system\WRQ.exeC:\windows\system\WRQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\system\PJX.exeC:\windows\system\PJX.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEQO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\RVEQO.exeC:\windows\system32\RVEQO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMTKHKX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\system\LMTKHKX.exeC:\windows\system\LMTKHKX.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\IED.exeC:\windows\IED.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\QSP.exeC:\windows\QSP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDMWXG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\windows\UDMWXG.exeC:\windows\UDMWXG.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\PWFM.exeC:\windows\PWFM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\JXL.exeC:\windows\JXL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNMH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\windows\ZNMH.exeC:\windows\ZNMH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URZS.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\URZS.exeC:\windows\URZS.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXS.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\YXS.exeC:\windows\YXS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\JDOM.exeC:\windows\JDOM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMI.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5224 -
C:\windows\system\YMI.exeC:\windows\system\YMI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFX.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3004 -
C:\windows\system\RFX.exeC:\windows\system\RFX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "70⤵PID:2912
-
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVSUM.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5052 -
C:\windows\SysWOW64\MVSUM.exeC:\windows\system32\MVSUM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQXEWGZ.exe.bat" "74⤵PID:1004
-
C:\windows\system\HQXEWGZ.exeC:\windows\system\HQXEWGZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJZ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\windows\EJZ.exeC:\windows\EJZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "78⤵PID:4448
-
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IURKRKX.exe.bat" "80⤵PID:1300
-
C:\windows\SysWOW64\IURKRKX.exeC:\windows\system32\IURKRKX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPWT.exe.bat" "82⤵PID:4976
-
C:\windows\DPWT.exeC:\windows\DPWT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVBA.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2760 -
C:\windows\system\LVBA.exeC:\windows\system\LVBA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBBOO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5956 -
C:\windows\LBBOO.exeC:\windows\LBBOO.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWSYH.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\system\OWSYH.exeC:\windows\system\OWSYH.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBKMJU.exe.bat" "90⤵PID:4088
-
C:\windows\system\OBKMJU.exeC:\windows\system\OBKMJU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "92⤵PID:2148
-
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZG.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4132 -
C:\windows\SysWOW64\DZG.exeC:\windows\system32\DZG.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNCE.exe.bat" "96⤵PID:2456
-
C:\windows\SysWOW64\YNCE.exeC:\windows\system32\YNCE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NDMVQS.exe.bat" "98⤵PID:6072
-
C:\windows\SysWOW64\NDMVQS.exeC:\windows\system32\NDMVQS.exe99⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYVA.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\system\DYVA.exeC:\windows\system\DYVA.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "102⤵PID:2840
-
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMJR.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4876 -
C:\windows\SysWOW64\HMJR.exeC:\windows\system32\HMJR.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHNMDF.exe.bat" "106⤵PID:3740
-
C:\windows\AHNMDF.exeC:\windows\AHNMDF.exe107⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKR.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1340 -
C:\windows\BKR.exeC:\windows\BKR.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZAKL.exe.bat" "110⤵PID:1396
-
C:\windows\ZAKL.exeC:\windows\ZAKL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLIGD.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5868 -
C:\windows\DLIGD.exeC:\windows\DLIGD.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAUJQ.exe.bat" "114⤵PID:2572
-
C:\windows\CAUJQ.exeC:\windows\CAUJQ.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTXU.exe.bat" "116⤵PID:4480
-
C:\windows\NTXU.exeC:\windows\NTXU.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHBI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:120 -
C:\windows\VHBI.exeC:\windows\VHBI.exe119⤵
- Executes dropped EXE
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUGSTE.exe.bat" "120⤵PID:4640
-
C:\windows\system\QUGSTE.exeC:\windows\system\QUGSTE.exe121⤵
- Executes dropped EXE
PID:4164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-