Analysis
- max time kernel
85s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe
- Size 208KB
- Sample260820-s2jbdazfpc
- SHA256 443c7c79335747f3dfca4a138348b15fb5ec2a7f62e72068200e3caf8b8186be
- MD5 4a9db1caf055433d88780f3d2b9f2c20
- SHA1 a64797002b6766d1cb154b13df9ff775c3147fb3
- SHA512 d5ddfab27bfdc7683c12cea7b4045f2e5d9b68d22a4bf641640907d5058b0131faa18fc2bac6ad21a6d78aaa53b7c22e48b802c328083fa04f113813deae02f4
- SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfQ4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LOYkEj1
- TLSH T1DF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5200 OYO.exe 4404 PLOM.exe 1784 XRB.exe 5356 BHHBLY.exe 5824 KHJGPDX.exe 2076 JAMWXJ.exe 2984 YVWA.exe 5876 HVYNU.exe 2204 RTLAB.exe 2248 QEOQ.exe 2420 HMCV.exe 4800 GXF.exe 4760 KNMLJ.exe 4060 TNOQVL.exe 5968 OYEPJV.exe 1948 HBI.exe 6012 GMLAXRB.exe 3392 QKRVFAK.exe 4436 KXVE.exe 3688 ONCEBS.exe 5664 SVR.exe 5336 CTWGVS.exe 3396 MTYM.exe 2296 BJZDF.exe 292 FZGLR.exe 3836 UUP.exe 2116 VXTTI.exe 3160 EYVYTE.exe 2656 IOC.exe 5244 DBGII.exe 1992 UBI.exe 1288 WXAW.exe 5320 ENBWL.exe 4516 FQFR.exe 3724 NVRY.exe 4432 CQBKMJF.exe 4928 AMA.exe 5204 VWI.exe 5604 QKNT.exe 5792 AHBFXFG.exe 1156 HXCFD.exe 2912 IAFBJRE.exe 5944 VDOZXUZ.exe 5344 WGSD.exe 5556 ZOYDPC.exe 4196 JXA.exe 244 TUOCAQI.exe 4092 LXSG.exe 5416 HAAX.exe 568 FWZFY.exe 5976 LWHTPOV.exe 4840 CEJ.exe 1456 PHR.exe 2860 TXGXTG.exe 1228 KXACWMJ.exe 5748 DAMGCC.exe 2504 YOJ.exe 1404 SBNZW.exe 3224 ETQR.exe 5148 TWAWQDM.exe 5060 ZKZWM.exe 596 ONJJFTC.exe 3812 XNLO.exe 200 BDROVJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GVQ.exe PUOCLYJ.exe File created C:\windows\SysWOW64\XEMUW.exe.bat TWX.exe File created C:\windows\SysWOW64\MVU.exe LSIP.exe File created C:\windows\SysWOW64\VRDSI.exe.bat FBCT.exe File created C:\windows\SysWOW64\THON.exe.bat VRDSI.exe File created C:\windows\SysWOW64\KNMLJ.exe GXF.exe File created C:\windows\SysWOW64\EYVYTE.exe.bat VXTTI.exe File created C:\windows\SysWOW64\YOJ.exe.bat DAMGCC.exe File created C:\windows\SysWOW64\SBNZW.exe YOJ.exe File created C:\windows\SysWOW64\SBNZW.exe.bat YOJ.exe File created C:\windows\SysWOW64\ETQR.exe SBNZW.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe UICBQ.exe File created C:\windows\SysWOW64\MVU.exe.bat LSIP.exe File opened for modification C:\windows\SysWOW64\YVWA.exe JAMWXJ.exe File created C:\windows\SysWOW64\PDNISB.exe WIJNFDM.exe File opened for modification C:\windows\SysWOW64\XNLO.exe ONJJFTC.exe File created C:\windows\SysWOW64\YVWA.exe JAMWXJ.exe File created C:\windows\SysWOW64\RTLAB.exe.bat HVYNU.exe File created C:\windows\SysWOW64\KNMLJ.exe.bat GXF.exe File created C:\windows\SysWOW64\QKRVFAK.exe.bat GMLAXRB.exe File opened for modification C:\windows\SysWOW64\ZOYDPC.exe WGSD.exe File opened for modification C:\windows\SysWOW64\ONJJFTC.exe ZKZWM.exe File created C:\windows\SysWOW64\THON.exe VRDSI.exe File created C:\windows\SysWOW64\CQBKMJF.exe NVRY.exe File created C:\windows\SysWOW64\TNOQVL.exe.bat KNMLJ.exe File created C:\windows\SysWOW64\MTYM.exe CTWGVS.exe File opened for modification C:\windows\SysWOW64\MTYM.exe CTWGVS.exe File created C:\windows\SysWOW64\NVRY.exe.bat FQFR.exe File created C:\windows\SysWOW64\XNLO.exe.bat ONJJFTC.exe File created C:\windows\SysWOW64\VSIT.exe.bat LUDZJGN.exe File created C:\windows\SysWOW64\JAMWXJ.exe.bat KHJGPDX.exe File created C:\windows\SysWOW64\TNOQVL.exe KNMLJ.exe File opened for modification C:\windows\SysWOW64\QKRVFAK.exe GMLAXRB.exe File created C:\windows\SysWOW64\NVRY.exe FQFR.exe File created C:\windows\SysWOW64\IDQ.exe CQRDH.exe File created C:\windows\SysWOW64\PDNISB.exe.bat WIJNFDM.exe File created C:\windows\SysWOW64\KWOQ.exe VBEEAU.exe File created C:\windows\SysWOW64\KWOQ.exe.bat VBEEAU.exe File opened for modification C:\windows\SysWOW64\CQBKMJF.exe NVRY.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat IAFBJRE.exe File opened for modification C:\windows\SysWOW64\BDROVJ.exe XNLO.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat UICBQ.exe File opened for modification C:\windows\SysWOW64\WIJNFDM.exe XPGXW.exe File created C:\windows\SysWOW64\WIJNFDM.exe.bat XPGXW.exe File created C:\windows\SysWOW64\XEMUW.exe TWX.exe File created C:\windows\SysWOW64\VRDSI.exe FBCT.exe File opened for modification C:\windows\SysWOW64\IAFBJRE.exe HXCFD.exe File created C:\windows\SysWOW64\IAFBJRE.exe.bat HXCFD.exe File created C:\windows\SysWOW64\ZOYDPC.exe.bat WGSD.exe File opened for modification C:\windows\SysWOW64\ETQR.exe SBNZW.exe File created C:\windows\SysWOW64\BDROVJ.exe XNLO.exe File created C:\windows\SysWOW64\VVEPZ.exe.bat RFX.exe File opened for modification C:\windows\SysWOW64\THON.exe VRDSI.exe File created C:\windows\SysWOW64\YVWA.exe.bat JAMWXJ.exe File created C:\windows\SysWOW64\WGSD.exe VDOZXUZ.exe File created C:\windows\SysWOW64\GLHORJS.exe WNTTKBS.exe File opened for modification C:\windows\SysWOW64\XEMUW.exe TWX.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe RFX.exe File opened for modification C:\windows\SysWOW64\MVU.exe LSIP.exe File opened for modification C:\windows\SysWOW64\SBNZW.exe YOJ.exe File created C:\windows\SysWOW64\ONJJFTC.exe ZKZWM.exe File opened for modification C:\windows\SysWOW64\GVQ.exe PUOCLYJ.exe File opened for modification C:\windows\SysWOW64\VSIT.exe LUDZJGN.exe File opened for modification C:\windows\SysWOW64\TNOQVL.exe KNMLJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\PHR.exe CEJ.exe File created C:\windows\XUCTRHH.exe TEOT.exe File created C:\windows\system\VBEEAU.exe.bat VVEPZ.exe File created C:\windows\TDT.exe.bat VSIT.exe File created C:\windows\OYEPJV.exe TNOQVL.exe File created C:\windows\system\VXTTI.exe UUP.exe File created C:\windows\CQRDH.exe.bat GLHORJS.exe File created C:\windows\KLXPBO.exe.bat GVQ.exe File created C:\windows\system\UICBQ.exe.bat KLXPBO.exe File created C:\windows\JGQ.exe.bat KWOQ.exe File created C:\windows\system\FQFR.exe ENBWL.exe File created C:\windows\system\FWZFY.exe.bat HAAX.exe File created C:\windows\system\BHHBLY.exe XRB.exe File created C:\windows\system\UBI.exe.bat DBGII.exe File created C:\windows\AHBFXFG.exe.bat QKNT.exe File created C:\windows\MWJEIHL.exe.bat CYVSB.exe File opened for modification C:\windows\system\VELRTN.exe MWJEIHL.exe File opened for modification C:\windows\LEHC.exe JHUIR.exe File opened for modification C:\windows\KLXPBO.exe GVQ.exe File created C:\windows\system\XPGXW.exe.bat XUCTRHH.exe File created C:\windows\system\KHJGPDX.exe.bat BHHBLY.exe File created C:\windows\system\ONCEBS.exe.bat KXVE.exe File created C:\windows\system\WXAW.exe.bat UBI.exe File opened for modification C:\windows\system\RFX.exe CPWQ.exe File created C:\windows\REMGTGR.exe.bat WRHXIG.exe File created C:\windows\system\HMWZ.exe THON.exe File created C:\windows\system\LUDZJGN.exe HMWZ.exe File created C:\windows\CEJ.exe LWHTPOV.exe File created C:\windows\system\WXAW.exe UBI.exe File created C:\windows\system\QKNT.exe VWI.exe File created C:\windows\system\QKNT.exe.bat VWI.exe File created C:\windows\system\LXSG.exe TUOCAQI.exe File opened for modification C:\windows\system\ZKZWM.exe TWAWQDM.exe File created C:\windows\system\PUOCLYJ.exe.bat LEHC.exe File opened for modification C:\windows\REMGTGR.exe WRHXIG.exe File created C:\windows\PLOM.exe.bat OYO.exe File opened for modification C:\windows\OYEPJV.exe TNOQVL.exe File created C:\windows\BJZDF.exe.bat MTYM.exe File created C:\windows\AMA.exe.bat CQBKMJF.exe File created C:\windows\system\TWAWQDM.exe ETQR.exe File opened for modification C:\windows\system\TWX.exe PGR.exe File created C:\windows\system\RFX.exe CPWQ.exe File opened for modification C:\windows\PLOM.exe OYO.exe File created C:\windows\OYEPJV.exe.bat TNOQVL.exe File opened for modification C:\windows\system\LXSG.exe TUOCAQI.exe File created C:\windows\system\LWHTPOV.exe FWZFY.exe File created C:\windows\system\TXGXTG.exe PHR.exe File created C:\windows\system\DAMGCC.exe KXACWMJ.exe File created C:\windows\system\CYVSB.exe.bat BDROVJ.exe File created C:\windows\system\WNTTKBS.exe DKPYE.exe File created C:\windows\system\DBGII.exe.bat IOC.exe File created C:\windows\LEHC.exe.bat JHUIR.exe File created C:\windows\KLXPBO.exe GVQ.exe File created C:\windows\system\TEOT.exe AJKPZZR.exe File created C:\windows\system\TEOT.exe.bat AJKPZZR.exe File created C:\windows\system\XPGXW.exe XUCTRHH.exe File opened for modification C:\windows\LSIP.exe REMGTGR.exe File created C:\windows\system\SQLU.exe MVU.exe File created C:\windows\system\XRB.exe.bat PLOM.exe File opened for modification C:\windows\system\HVYNU.exe YVWA.exe File opened for modification C:\windows\system\VXTTI.exe UUP.exe File created C:\windows\system\FQFR.exe.bat ENBWL.exe File opened for modification C:\windows\system\JXA.exe ZOYDPC.exe File created C:\windows\CEJ.exe.bat LWHTPOV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5688 cmd.exe 5864 cmd.exe 2232 cmd.exe 3796 cmd.exe 4032 cmd.exe 3632 cmd.exe 2044 cmd.exe 4604 cmd.exe 1168 cmd.exe 804 cmd.exe 4072 cmd.exe 4496 cmd.exe 4752 cmd.exe 2956 cmd.exe 1204 cmd.exe 3536 cmd.exe 4176 cmd.exe 3608 cmd.exe 540 cmd.exe 4264 cmd.exe 3768 cmd.exe 3508 cmd.exe 5088 cmd.exe 5816 cmd.exe 4044 cmd.exe 3228 cmd.exe 4240 cmd.exe 1600 cmd.exe 2824 cmd.exe 2868 cmd.exe 2704 cmd.exe 3644 cmd.exe 936 cmd.exe 928 cmd.exe 2156 cmd.exe 3036 cmd.exe 3060 cmd.exe 2040 cmd.exe 2472 cmd.exe 2832 cmd.exe 1272 cmd.exe 5964 cmd.exe 3440 cmd.exe 4224 cmd.exe 4700 cmd.exe 5432 cmd.exe 5072 cmd.exe 4356 cmd.exe 1604 cmd.exe 3496 cmd.exe 4680 cmd.exe 4168 cmd.exe 6064 cmd.exe 4052 cmd.exe 5760 cmd.exe 260 cmd.exe 2712 cmd.exe 4460 cmd.exe 840 cmd.exe 4064 cmd.exe 1548 cmd.exe 5868 cmd.exe 3696 cmd.exe 4288 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2096 5920 WerFault.exe 87 4156 5200 WerFault.exe 93 1180 4404 WerFault.exe 99 2688 1784 WerFault.exe 104 4184 5356 WerFault.exe 109 3500 5824 WerFault.exe 114 3196 2076 WerFault.exe 119 5148 2984 WerFault.exe 124 3216 5876 WerFault.exe 129 5664 2204 WerFault.exe 134 1752 2248 WerFault.exe 139 3680 2420 WerFault.exe 144 2712 4800 WerFault.exe 149 2300 4760 WerFault.exe 154 5536 4060 WerFault.exe 159 4824 5968 WerFault.exe 164 3036 1948 WerFault.exe 169 1700 6012 WerFault.exe 174 1816 3392 WerFault.exe 179 3308 4436 WerFault.exe 184 5076 3688 WerFault.exe 189 2552 5664 WerFault.exe 194 5860 5336 WerFault.exe 199 2572 3396 WerFault.exe 204 6092 2296 WerFault.exe 209 1512 292 WerFault.exe 214 3212 3836 WerFault.exe 219 3644 2116 WerFault.exe 224 5072 3160 WerFault.exe 229 5976 2656 WerFault.exe 234 1444 5244 WerFault.exe 239 4244 1992 WerFault.exe 244 4496 1288 WerFault.exe 249 4804 5320 WerFault.exe 254 5964 4516 WerFault.exe 259 4768 3724 WerFault.exe 264 2924 4432 WerFault.exe 269 2824 4928 WerFault.exe 275 5412 5204 WerFault.exe 280 6040 5604 WerFault.exe 285 3308 5792 WerFault.exe 290 1352 1156 WerFault.exe 295 932 2912 WerFault.exe 300 976 5944 WerFault.exe 305 3240 5344 WerFault.exe 310 4308 5556 WerFault.exe 315 4084 4196 WerFault.exe 320 4176 244 WerFault.exe 325 540 4092 WerFault.exe 330 3884 5416 WerFault.exe 335 2156 568 WerFault.exe 340 2672 5976 WerFault.exe 345 3632 4840 WerFault.exe 350 3536 1456 WerFault.exe 355 2780 2860 WerFault.exe 360 3488 1228 WerFault.exe 365 3464 5748 WerFault.exe 370 3820 2504 WerFault.exe 375 3644 1404 WerFault.exe 380 1124 3224 WerFault.exe 385 2980 5148 WerFault.exe 390 4244 5060 WerFault.exe 395 5408 596 WerFault.exe 400 4200 3812 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUCTRHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWZFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVYNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQBKMJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHJGPDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJEIHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWHTPOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNISB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUDZJGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHBFXFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUOCAQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTLAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAMGCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REMGTGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAMWXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDROVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRDSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5920 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe 5920 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe 5200 OYO.exe 5200 OYO.exe 4404 PLOM.exe 4404 PLOM.exe 1784 XRB.exe 1784 XRB.exe 5356 BHHBLY.exe 5356 BHHBLY.exe 5824 KHJGPDX.exe 5824 KHJGPDX.exe 2076 JAMWXJ.exe 2076 JAMWXJ.exe 2984 YVWA.exe 2984 YVWA.exe 5876 HVYNU.exe 5876 HVYNU.exe 2204 RTLAB.exe 2204 RTLAB.exe 2248 QEOQ.exe 2248 QEOQ.exe 2420 HMCV.exe 2420 HMCV.exe 4800 GXF.exe 4800 GXF.exe 4760 KNMLJ.exe 4760 KNMLJ.exe 4060 TNOQVL.exe 4060 TNOQVL.exe 5968 OYEPJV.exe 5968 OYEPJV.exe 1948 HBI.exe 1948 HBI.exe 6012 GMLAXRB.exe 6012 GMLAXRB.exe 3392 QKRVFAK.exe 3392 QKRVFAK.exe 4436 KXVE.exe 4436 KXVE.exe 3688 ONCEBS.exe 3688 ONCEBS.exe 5664 SVR.exe 5664 SVR.exe 5336 CTWGVS.exe 5336 CTWGVS.exe 3396 MTYM.exe 3396 MTYM.exe 2296 BJZDF.exe 2296 BJZDF.exe 292 FZGLR.exe 292 FZGLR.exe 3836 UUP.exe 3836 UUP.exe 2116 VXTTI.exe 2116 VXTTI.exe 3160 EYVYTE.exe 3160 EYVYTE.exe 2656 IOC.exe 2656 IOC.exe 5244 DBGII.exe 5244 DBGII.exe 1992 UBI.exe 1992 UBI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5920 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe 5920 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe 5200 OYO.exe 5200 OYO.exe 4404 PLOM.exe 4404 PLOM.exe 1784 XRB.exe 1784 XRB.exe 5356 BHHBLY.exe 5356 BHHBLY.exe 5824 KHJGPDX.exe 5824 KHJGPDX.exe 2076 JAMWXJ.exe 2076 JAMWXJ.exe 2984 YVWA.exe 2984 YVWA.exe 5876 HVYNU.exe 5876 HVYNU.exe 2204 RTLAB.exe 2204 RTLAB.exe 2248 QEOQ.exe 2248 QEOQ.exe 2420 HMCV.exe 2420 HMCV.exe 4800 GXF.exe 4800 GXF.exe 4760 KNMLJ.exe 4760 KNMLJ.exe 4060 TNOQVL.exe 4060 TNOQVL.exe 5968 OYEPJV.exe 5968 OYEPJV.exe 1948 HBI.exe 1948 HBI.exe 6012 GMLAXRB.exe 6012 GMLAXRB.exe 3392 QKRVFAK.exe 3392 QKRVFAK.exe 4436 KXVE.exe 4436 KXVE.exe 3688 ONCEBS.exe 3688 ONCEBS.exe 5664 SVR.exe 5664 SVR.exe 5336 CTWGVS.exe 5336 CTWGVS.exe 3396 MTYM.exe 3396 MTYM.exe 2296 BJZDF.exe 2296 BJZDF.exe 292 FZGLR.exe 292 FZGLR.exe 3836 UUP.exe 3836 UUP.exe 2116 VXTTI.exe 2116 VXTTI.exe 3160 EYVYTE.exe 3160 EYVYTE.exe 2656 IOC.exe 2656 IOC.exe 5244 DBGII.exe 5244 DBGII.exe 1992 UBI.exe 1992 UBI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5920 wrote to memory of 4764 5920 2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe 89 PID 4764 wrote to memory of 5200 4764 cmd.exe 93 PID 5200 wrote to memory of 3188 5200 OYO.exe 95 PID 3188 wrote to memory of 4404 3188 cmd.exe 99 PID 4404 wrote to memory of 4504 4404 PLOM.exe 100 PID 4504 wrote to memory of 1784 4504 cmd.exe 104 PID 1784 wrote to memory of 4076 1784 XRB.exe 105 PID 4076 wrote to memory of 5356 4076 cmd.exe 109 PID 5356 wrote to memory of 2032 5356 BHHBLY.exe 110 PID 2032 wrote to memory of 5824 2032 cmd.exe 114 PID 5824 wrote to memory of 5524 5824 KHJGPDX.exe 115 PID 5524 wrote to memory of 2076 5524 cmd.exe 119 PID 2076 wrote to memory of 4224 2076 JAMWXJ.exe 120 PID 4224 wrote to memory of 2984 4224 cmd.exe 124 PID 2984 wrote to memory of 5932 2984 YVWA.exe 125 PID 5932 wrote to memory of 5876 5932 cmd.exe 129 PID 5876 wrote to memory of 2472 5876 HVYNU.exe 130 PID 2472 wrote to memory of 2204 2472 cmd.exe 134 PID 2204 wrote to memory of 2072 2204 RTLAB.exe 135 PID 2072 wrote to memory of 2248 2072 cmd.exe 139 PID 2248 wrote to memory of 3784 2248 QEOQ.exe 140 PID 3784 wrote to memory of 2420 3784 cmd.exe 144 PID 2420 wrote to memory of 3404 2420 HMCV.exe 145 PID 3404 wrote to memory of 4800 3404 cmd.exe 149 PID 4800 wrote to memory of 6100 4800 GXF.exe 150 PID 6100 wrote to memory of 4760 6100 cmd.exe 154 PID 4760 wrote to memory of 3924 4760 KNMLJ.exe 155 PID 3924 wrote to memory of 4060 3924 cmd.exe 159 PID 4060 wrote to memory of 120 4060 TNOQVL.exe 160 PID 120 wrote to memory of 5968 120 cmd.exe 164 PID 5968 wrote to memory of 5628 5968 OYEPJV.exe 165 PID 5628 wrote to memory of 1948 5628 cmd.exe 169 PID 1948 wrote to memory of 5688 1948 HBI.exe 170 PID 5688 wrote to memory of 6012 5688 cmd.exe 174 PID 6012 wrote to memory of 3136 6012 GMLAXRB.exe 175 PID 3136 wrote to memory of 3392 3136 cmd.exe 179 PID 3392 wrote to memory of 2828 3392 QKRVFAK.exe 180 PID 2828 wrote to memory of 4436 2828 cmd.exe 184 PID 4436 wrote to memory of 5756 4436 KXVE.exe 185 PID 5756 wrote to memory of 3688 5756 cmd.exe 189 PID 3688 wrote to memory of 5660 3688 ONCEBS.exe 190 PID 5660 wrote to memory of 5664 5660 cmd.exe 194 PID 5664 wrote to memory of 3760 5664 SVR.exe 195 PID 3760 wrote to memory of 5336 3760 cmd.exe 199 PID 5336 wrote to memory of 1548 5336 CTWGVS.exe 200 PID 1548 wrote to memory of 3396 1548 cmd.exe 204 PID 3396 wrote to memory of 5196 3396 MTYM.exe 205 PID 5196 wrote to memory of 2296 5196 cmd.exe 209 PID 2296 wrote to memory of 5780 2296 BJZDF.exe 210 PID 5780 wrote to memory of 292 5780 cmd.exe 214 PID 292 wrote to memory of 5868 292 FZGLR.exe 215 PID 5868 wrote to memory of 3836 5868 cmd.exe 219 PID 3836 wrote to memory of 260 3836 UUP.exe 220 PID 260 wrote to memory of 2116 260 cmd.exe 224 PID 2116 wrote to memory of 3496 2116 VXTTI.exe 225 PID 3496 wrote to memory of 3160 3496 cmd.exe 229 PID 3160 wrote to memory of 2480 3160 EYVYTE.exe 230 PID 2480 wrote to memory of 2656 2480 cmd.exe 234 PID 2656 wrote to memory of 2500 2656 IOC.exe 235 PID 2500 wrote to memory of 5244 2500 cmd.exe 239 PID 5244 wrote to memory of 5236 5244 DBGII.exe 240 PID 5236 wrote to memory of 1992 5236 cmd.exe 244 PID 1992 wrote to memory of 3216 1992 UBI.exe 245 PID 3216 wrote to memory of 1288 3216 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4a9db1caf055433d88780f3d2b9f2c20_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OYO.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\OYO.exeC:\windows\OYO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLOM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\PLOM.exeC:\windows\PLOM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRB.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\system\XRB.exeC:\windows\system\XRB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BHHBLY.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\BHHBLY.exeC:\windows\system\BHHBLY.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KHJGPDX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\system\KHJGPDX.exeC:\windows\system\KHJGPDX.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAMWXJ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\SysWOW64\JAMWXJ.exeC:\windows\system32\JAMWXJ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVWA.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\YVWA.exeC:\windows\system32\YVWA.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVYNU.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\HVYNU.exeC:\windows\system\HVYNU.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTLAB.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\SysWOW64\RTLAB.exeC:\windows\system32\RTLAB.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QEOQ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\system\QEOQ.exeC:\windows\system\QEOQ.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMCV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\system\HMCV.exeC:\windows\system\HMCV.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXF.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\system\GXF.exeC:\windows\system\GXF.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNMLJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\SysWOW64\KNMLJ.exeC:\windows\system32\KNMLJ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNOQVL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\SysWOW64\TNOQVL.exeC:\windows\system32\TNOQVL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OYEPJV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\OYEPJV.exeC:\windows\OYEPJV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\HBI.exeC:\windows\system\HBI.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMLAXRB.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\GMLAXRB.exeC:\windows\GMLAXRB.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKRVFAK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\QKRVFAK.exeC:\windows\system32\QKRVFAK.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXVE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\KXVE.exeC:\windows\KXVE.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONCEBS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\system\ONCEBS.exeC:\windows\system\ONCEBS.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVR.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\SVR.exeC:\windows\SVR.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTWGVS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\windows\system\CTWGVS.exeC:\windows\system\CTWGVS.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTYM.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\SysWOW64\MTYM.exeC:\windows\system32\MTYM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJZDF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\BJZDF.exeC:\windows\BJZDF.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZGLR.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\FZGLR.exeC:\windows\FZGLR.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUP.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\UUP.exeC:\windows\UUP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VXTTI.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\system\VXTTI.exeC:\windows\system\VXTTI.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYVYTE.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\SysWOW64\EYVYTE.exeC:\windows\system32\EYVYTE.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\system\IOC.exeC:\windows\system\IOC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBGII.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\DBGII.exeC:\windows\system\DBGII.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBI.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\system\UBI.exeC:\windows\system\UBI.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENBWL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3768 -
C:\windows\system\ENBWL.exeC:\windows\system\ENBWL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQFR.exe.bat" "68⤵PID:2128
-
C:\windows\system\FQFR.exeC:\windows\system\FQFR.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVRY.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2044 -
C:\windows\SysWOW64\NVRY.exeC:\windows\system32\NVRY.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "72⤵PID:1760
-
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMA.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3696 -
C:\windows\AMA.exeC:\windows\AMA.exe75⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5720 -
C:\windows\system\VWI.exeC:\windows\system\VWI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QKNT.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2832 -
C:\windows\system\QKNT.exeC:\windows\system\QKNT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHBFXFG.exe.bat" "80⤵PID:5724
-
C:\windows\AHBFXFG.exeC:\windows\AHBFXFG.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXCFD.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4168 -
C:\windows\HXCFD.exeC:\windows\HXCFD.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAFBJRE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4288 -
C:\windows\SysWOW64\IAFBJRE.exeC:\windows\system32\IAFBJRE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOYDPC.exe.bat" "90⤵PID:2180
-
C:\windows\SysWOW64\ZOYDPC.exeC:\windows\system32\ZOYDPC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXA.exe.bat" "92⤵PID:3600
-
C:\windows\system\JXA.exeC:\windows\system\JXA.exe93⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXSG.exe.bat" "96⤵PID:5468
-
C:\windows\system\LXSG.exeC:\windows\system\LXSG.exe97⤵
- Executes dropped EXE
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4700 -
C:\windows\HAAX.exeC:\windows\HAAX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "100⤵PID:2736
-
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1272 -
C:\windows\CEJ.exeC:\windows\CEJ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4460 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXGXTG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:840 -
C:\windows\system\TXGXTG.exeC:\windows\system\TXGXTG.exe109⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4064 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "112⤵PID:4924
-
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOJ.exe.bat" "114⤵PID:6096
-
C:\windows\SysWOW64\YOJ.exeC:\windows\system32\YOJ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SBNZW.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4752 -
C:\windows\SysWOW64\SBNZW.exeC:\windows\system32\SBNZW.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4544 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4680 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-