Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe
- Size 208KB
- Sample260826-1hwflafe83
- SHA256 e7107518a484c57e51a88cb778e3f30bbf46c961d49ab8b7ee37171401248f07
- MD5 71f76e459973df0970c61f465a53ecab
- SHA1 cbd2f95bfbc766db74781d1140100e5683d38dfd
- SHA512 a101046462413fc54a8132b3e2eb4b7a3c60eedf602dbca98b63cd10163aa58e80fb960b0af13bd562fdb9299255f6e98b33a4a68ce86584aa28ef6202d2186e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfz4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LObQEj6
- TLSH T17A247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4876 DRU.exe 4932 MPOKP.exe 3952 JHQVT.exe 440 ESG.exe 5788 MYLSSAO.exe 5096 QOSAE.exe 1640 GEB.exe 4460 PEVE.exe 5724 CPLV.exe 4180 GXSDGGL.exe 2092 XFU.exe 5704 UGVKWIW.exe 1356 TZTJ.exe 5996 OHBGDX.exe 124 JSKE.exe 3800 HFJF.exe 1856 DQRE.exe 4208 KGSVJJ.exe 4688 FRJUXU.exe 3576 NHKLWHO.exe 4828 TWV.exe 5336 XZT.exe 4216 ECLOCB.exe 2760 QKROOL.exe 1692 LYW.exe 5772 EBAB.exe 2876 VJCGPG.exe 1672 BJK.exe 1136 VXODI.exe 4524 UHRT.exe 5196 NLVXWE.exe 2520 GDKIGF.exe 5688 VTLZ.exe 6080 ZBSHZLC.exe 2244 PRTYF.exe 5580 NPE.exe 1436 RSCXSF.exe 6088 OYVMJ.exe 2300 DOW.exe 5276 WRZHV.exe 3304 IZO.exe 3200 VJX.exe 5116 UUZWEUA.exe 1428 NXD.exe 5552 EYFWN.exe 2892 CYNKEKM.exe 4912 AJYAEY.exe 4924 VEU.exe 3016 YRZTZ.exe 4348 LCQ.exe 52 FPUB.exe 3272 PQW.exe 576 RLTX.exe 5860 FOKORII.exe 4620 QGNH.exe 4164 KUJQK.exe 4464 LHKFLC.exe 3260 FUP.exe 1744 AFXNKN.exe 4668 TAJRP.exe 1156 OWGAZDH.exe 2460 QJK.exe 2928 LWPTM.exe 4228 UERYXA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\QKROOL.exe ECLOCB.exe File created C:\windows\SysWOW64\DRU.exe.bat 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe File created C:\windows\SysWOW64\QOSAE.exe.bat MYLSSAO.exe File created C:\windows\SysWOW64\HFJF.exe.bat JSKE.exe File created C:\windows\SysWOW64\TWV.exe.bat NHKLWHO.exe File opened for modification C:\windows\SysWOW64\VXODI.exe BJK.exe File opened for modification C:\windows\SysWOW64\UUZWEUA.exe VJX.exe File opened for modification C:\windows\SysWOW64\EYFWN.exe NXD.exe File created C:\windows\SysWOW64\DRU.exe 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\TWV.exe NHKLWHO.exe File created C:\windows\SysWOW64\UUZWEUA.exe.bat VJX.exe File created C:\windows\SysWOW64\EYFWN.exe NXD.exe File opened for modification C:\windows\SysWOW64\KUJQK.exe QGNH.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe LSVG.exe File opened for modification C:\windows\SysWOW64\YDTDMK.exe DPWT.exe File opened for modification C:\windows\SysWOW64\MKG.exe VXWZT.exe File created C:\windows\SysWOW64\HFJF.exe JSKE.exe File created C:\windows\SysWOW64\TWV.exe NHKLWHO.exe File created C:\windows\SysWOW64\FPUB.exe LCQ.exe File created C:\windows\SysWOW64\KUJQK.exe.bat QGNH.exe File created C:\windows\SysWOW64\OWGAZDH.exe.bat TAJRP.exe File created C:\windows\SysWOW64\NTADWQT.exe TGVUL.exe File created C:\windows\SysWOW64\UUZWEUA.exe VJX.exe File opened for modification C:\windows\SysWOW64\CYNKEKM.exe EYFWN.exe File opened for modification C:\windows\SysWOW64\VEU.exe AJYAEY.exe File created C:\windows\SysWOW64\IHF.exe NTADWQT.exe File opened for modification C:\windows\SysWOW64\EMDKN.exe IHF.exe File created C:\windows\SysWOW64\JSKE.exe.bat OHBGDX.exe File created C:\windows\SysWOW64\PRTYF.exe.bat ZBSHZLC.exe File created C:\windows\SysWOW64\ELQR.exe JXL.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat NTSWRC.exe File created C:\windows\SysWOW64\UPIZI.exe.bat ACD.exe File created C:\windows\SysWOW64\TGVUL.exe.bat LSVG.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat EMDKN.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat DPWT.exe File opened for modification C:\windows\SysWOW64\GXSDGGL.exe CPLV.exe File created C:\windows\SysWOW64\TGVUL.exe LSVG.exe File created C:\windows\SysWOW64\EMDKN.exe.bat IHF.exe File created C:\windows\SysWOW64\WLIX.exe MKG.exe File created C:\windows\SysWOW64\WLIX.exe.bat MKG.exe File created C:\windows\SysWOW64\UOU.exe ABPXYH.exe File created C:\windows\SysWOW64\UOU.exe.bat ABPXYH.exe File opened for modification C:\windows\SysWOW64\DRU.exe 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe File created C:\windows\SysWOW64\VTLZ.exe.bat GDKIGF.exe File opened for modification C:\windows\SysWOW64\PRTYF.exe ZBSHZLC.exe File opened for modification C:\windows\SysWOW64\UPIZI.exe ACD.exe File opened for modification C:\windows\SysWOW64\MXKOO.exe GXC.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat TGVUL.exe File created C:\windows\SysWOW64\PDVQPPL.exe YDTDMK.exe File created C:\windows\SysWOW64\GXSDGGL.exe.bat CPLV.exe File created C:\windows\SysWOW64\JSKE.exe OHBGDX.exe File opened for modification C:\windows\SysWOW64\JSKE.exe OHBGDX.exe File opened for modification C:\windows\SysWOW64\HFJF.exe JSKE.exe File created C:\windows\SysWOW64\VXODI.exe.bat BJK.exe File opened for modification C:\windows\SysWOW64\VTLZ.exe GDKIGF.exe File created C:\windows\SysWOW64\NPE.exe PRTYF.exe File opened for modification C:\windows\SysWOW64\FPUB.exe LCQ.exe File created C:\windows\SysWOW64\VEU.exe.bat AJYAEY.exe File created C:\windows\SysWOW64\QKROOL.exe.bat ECLOCB.exe File created C:\windows\SysWOW64\VTLZ.exe GDKIGF.exe File created C:\windows\SysWOW64\CYNKEKM.exe.bat EYFWN.exe File created C:\windows\SysWOW64\ETMJUZG.exe NTSWRC.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe NTSWRC.exe File created C:\windows\SysWOW64\UPIZI.exe ACD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\NLVXWE.exe.bat UHRT.exe File created C:\windows\system\YRZTZ.exe.bat VEU.exe File opened for modification C:\windows\system\JKCJVR.exe XCVB.exe File created C:\windows\CPLV.exe.bat PEVE.exe File created C:\windows\BER.exe PMW.exe File opened for modification C:\windows\DOW.exe OYVMJ.exe File created C:\windows\BJK.exe VJCGPG.exe File created C:\windows\CPLV.exe PEVE.exe File opened for modification C:\windows\UGVKWIW.exe XFU.exe File created C:\windows\system\QFQWAEM.exe MXKOO.exe File created C:\windows\UHRT.exe.bat VXODI.exe File created C:\windows\system\YTLCH.exe.bat STE.exe File opened for modification C:\windows\system\LYW.exe QKROOL.exe File opened for modification C:\windows\system\OYVMJ.exe RSCXSF.exe File created C:\windows\system\LWPTM.exe QJK.exe File created C:\windows\LIKGV.exe.bat APHN.exe File opened for modification C:\windows\FCSKYK.exe DERIZ.exe File opened for modification C:\windows\CTE.exe JYAZAP.exe File created C:\windows\QGNH.exe.bat FOKORII.exe File created C:\windows\system\NTSWRC.exe ELQR.exe File created C:\windows\system\FPYGOB.exe ZORS.exe File created C:\windows\system\JKCJVR.exe XCVB.exe File opened for modification C:\windows\system\ABPXYH.exe WLIX.exe File created C:\windows\system\OYVMJ.exe RSCXSF.exe File created C:\windows\LHKFLC.exe.bat KUJQK.exe File opened for modification C:\windows\ZPX.exe FCSKYK.exe File opened for modification C:\windows\JYAZAP.exe PDVQPPL.exe File created C:\windows\GEB.exe.bat QOSAE.exe File opened for modification C:\windows\system\PEVE.exe GEB.exe File created C:\windows\QGNH.exe FOKORII.exe File created C:\windows\ARCYMCT.exe RJA.exe File opened for modification C:\windows\system\STE.exe JKCJVR.exe File created C:\windows\system\XZT.exe TWV.exe File created C:\windows\BJK.exe.bat VJCGPG.exe File created C:\windows\system\FUP.exe.bat LHKFLC.exe File created C:\windows\system\EBAB.exe LYW.exe File created C:\windows\system\PEVE.exe GEB.exe File created C:\windows\GDKIGF.exe NLVXWE.exe File opened for modification C:\windows\system\QJK.exe OWGAZDH.exe File created C:\windows\FCSKYK.exe DERIZ.exe File created C:\windows\BER.exe.bat PMW.exe File created C:\windows\system\NHKLWHO.exe.bat FRJUXU.exe File created C:\windows\NLVXWE.exe UHRT.exe File created C:\windows\GDKIGF.exe.bat NLVXWE.exe File created C:\windows\system\OVHPFNH.exe.bat LIKGV.exe File created C:\windows\VEH.exe.bat ARCYMCT.exe File created C:\windows\system\OUBN.exe MWWTMMY.exe File created C:\windows\FCSKYK.exe.bat DERIZ.exe File created C:\windows\ZPX.exe FCSKYK.exe File opened for modification C:\windows\ARCYMCT.exe RJA.exe File created C:\windows\system\LYW.exe QKROOL.exe File created C:\windows\ZPX.exe.bat FCSKYK.exe File opened for modification C:\windows\MKA.exe IULJW.exe File created C:\windows\system\WRZHV.exe.bat DOW.exe File opened for modification C:\windows\system\FUP.exe LHKFLC.exe File created C:\windows\AFXNKN.exe FUP.exe File opened for modification C:\windows\TAJRP.exe AFXNKN.exe File opened for modification C:\windows\system\QFQWAEM.exe MXKOO.exe File opened for modification C:\windows\system\LSVG.exe QFQWAEM.exe File created C:\windows\MWWTMMY.exe UOU.exe File created C:\windows\system\KGSVJJ.exe DQRE.exe File opened for modification C:\windows\system\WRZHV.exe DOW.exe File opened for modification C:\windows\system\FOKORII.exe RLTX.exe File created C:\windows\system\LKCQFXJ.exe UERYXA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3548 cmd.exe 5992 cmd.exe 1296 cmd.exe 4988 cmd.exe 2972 cmd.exe 1216 cmd.exe 2308 cmd.exe 3768 cmd.exe 3896 cmd.exe 2000 cmd.exe 1344 cmd.exe 3056 cmd.exe 3308 cmd.exe 2140 cmd.exe 2424 cmd.exe 2248 cmd.exe 1488 cmd.exe 1580 cmd.exe 2312 cmd.exe 1072 cmd.exe 2104 cmd.exe 4944 cmd.exe 768 cmd.exe 4312 cmd.exe 1268 cmd.exe 3000 cmd.exe 5212 cmd.exe 3488 cmd.exe 4916 cmd.exe 5316 cmd.exe 5728 cmd.exe 4948 cmd.exe 4908 cmd.exe 3728 cmd.exe 4140 cmd.exe 3332 cmd.exe 3708 cmd.exe 3668 cmd.exe 5076 cmd.exe 1688 cmd.exe 1736 cmd.exe 5972 cmd.exe 4108 cmd.exe 2224 cmd.exe 3860 cmd.exe 4420 cmd.exe 1132 cmd.exe 4616 cmd.exe 5940 cmd.exe 4336 cmd.exe 824 cmd.exe 2484 cmd.exe 3468 cmd.exe 3028 cmd.exe 1300 cmd.exe 3208 cmd.exe 4132 cmd.exe 3320 cmd.exe 4300 cmd.exe 1920 cmd.exe 3036 cmd.exe 5356 cmd.exe 2884 cmd.exe 1792 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3260 4380 WerFault.exe 88 3664 4876 WerFault.exe 93 3212 4932 WerFault.exe 99 1140 3952 WerFault.exe 104 4908 440 WerFault.exe 109 2664 5788 WerFault.exe 114 1944 5096 WerFault.exe 119 928 1640 WerFault.exe 124 1216 4460 WerFault.exe 129 4772 5724 WerFault.exe 134 5404 4180 WerFault.exe 139 5352 2092 WerFault.exe 144 3620 5704 WerFault.exe 149 484 1404 WerFault.exe 154 2544 1356 WerFault.exe 159 5044 5996 WerFault.exe 164 4668 124 WerFault.exe 169 4628 3800 WerFault.exe 174 5880 1856 WerFault.exe 179 5836 4208 WerFault.exe 184 3100 4688 WerFault.exe 189 5952 3576 WerFault.exe 194 1556 4828 WerFault.exe 199 1104 5336 WerFault.exe 204 4376 4216 WerFault.exe 209 4768 2760 WerFault.exe 214 2424 1692 WerFault.exe 219 2596 5772 WerFault.exe 224 4760 2876 WerFault.exe 229 1172 1672 WerFault.exe 233 3432 1136 WerFault.exe 239 1752 4524 WerFault.exe 244 4148 5196 WerFault.exe 249 5952 2520 WerFault.exe 254 5176 5688 WerFault.exe 259 1104 6080 WerFault.exe 264 4748 2244 WerFault.exe 269 4108 5580 WerFault.exe 274 4268 1436 WerFault.exe 279 2440 6088 WerFault.exe 284 5608 2300 WerFault.exe 289 1944 5276 WerFault.exe 294 1976 3304 WerFault.exe 299 2824 3200 WerFault.exe 304 6104 5116 WerFault.exe 309 3356 1428 WerFault.exe 314 4680 5552 WerFault.exe 319 5924 2892 WerFault.exe 324 3660 4912 WerFault.exe 329 236 4924 WerFault.exe 334 1084 3016 WerFault.exe 339 4500 4348 WerFault.exe 344 3184 52 WerFault.exe 349 3216 3272 WerFault.exe 354 3228 576 WerFault.exe 359 4432 5860 WerFault.exe 364 924 4620 WerFault.exe 369 4856 4164 WerFault.exe 374 1536 4464 WerFault.exe 379 1632 3260 WerFault.exe 384 4136 1744 WerFault.exe 389 4788 4668 WerFault.exe 394 1976 1156 WerFault.exe 399 5980 2460 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSCXSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXWZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDVQPPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZORS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOKORII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTSWRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPIZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCSKYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXEUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXKOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHQVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYLSSAO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe 4380 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe 4876 DRU.exe 4876 DRU.exe 4932 MPOKP.exe 4932 MPOKP.exe 3952 JHQVT.exe 3952 JHQVT.exe 440 ESG.exe 440 ESG.exe 5788 MYLSSAO.exe 5788 MYLSSAO.exe 5096 QOSAE.exe 5096 QOSAE.exe 1640 GEB.exe 1640 GEB.exe 4460 PEVE.exe 4460 PEVE.exe 5724 CPLV.exe 5724 CPLV.exe 4180 GXSDGGL.exe 4180 GXSDGGL.exe 2092 XFU.exe 2092 XFU.exe 1404 HJMJKTR.exe 1404 HJMJKTR.exe 1356 TZTJ.exe 1356 TZTJ.exe 5996 OHBGDX.exe 5996 OHBGDX.exe 124 JSKE.exe 124 JSKE.exe 3800 HFJF.exe 3800 HFJF.exe 1856 DQRE.exe 1856 DQRE.exe 4208 KGSVJJ.exe 4208 KGSVJJ.exe 4688 FRJUXU.exe 4688 FRJUXU.exe 3576 NHKLWHO.exe 3576 NHKLWHO.exe 4828 TWV.exe 4828 TWV.exe 5336 XZT.exe 5336 XZT.exe 4216 ECLOCB.exe 4216 ECLOCB.exe 2760 QKROOL.exe 2760 QKROOL.exe 1692 LYW.exe 1692 LYW.exe 5772 EBAB.exe 5772 EBAB.exe 2876 VJCGPG.exe 2876 VJCGPG.exe 1672 BJK.exe 1672 BJK.exe 1136 VXODI.exe 1136 VXODI.exe 4524 UHRT.exe 4524 UHRT.exe 5196 NLVXWE.exe 5196 NLVXWE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4380 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe 4380 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe 4876 DRU.exe 4876 DRU.exe 4932 MPOKP.exe 4932 MPOKP.exe 3952 JHQVT.exe 3952 JHQVT.exe 440 ESG.exe 440 ESG.exe 5788 MYLSSAO.exe 5788 MYLSSAO.exe 5096 QOSAE.exe 5096 QOSAE.exe 1640 GEB.exe 1640 GEB.exe 4460 PEVE.exe 4460 PEVE.exe 5724 CPLV.exe 5724 CPLV.exe 4180 GXSDGGL.exe 4180 GXSDGGL.exe 2092 XFU.exe 2092 XFU.exe 1404 HJMJKTR.exe 1404 HJMJKTR.exe 1356 TZTJ.exe 1356 TZTJ.exe 5996 OHBGDX.exe 5996 OHBGDX.exe 124 JSKE.exe 124 JSKE.exe 3800 HFJF.exe 3800 HFJF.exe 1856 DQRE.exe 1856 DQRE.exe 4208 KGSVJJ.exe 4208 KGSVJJ.exe 4688 FRJUXU.exe 4688 FRJUXU.exe 3576 NHKLWHO.exe 3576 NHKLWHO.exe 4828 TWV.exe 4828 TWV.exe 5336 XZT.exe 5336 XZT.exe 4216 ECLOCB.exe 4216 ECLOCB.exe 2760 QKROOL.exe 2760 QKROOL.exe 1692 LYW.exe 1692 LYW.exe 5772 EBAB.exe 5772 EBAB.exe 2876 VJCGPG.exe 2876 VJCGPG.exe 1672 BJK.exe 1672 BJK.exe 1136 VXODI.exe 1136 VXODI.exe 4524 UHRT.exe 4524 UHRT.exe 5196 NLVXWE.exe 5196 NLVXWE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 4616 4380 2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe 89 PID 4616 wrote to memory of 4876 4616 cmd.exe 93 PID 4876 wrote to memory of 3568 4876 DRU.exe 95 PID 3568 wrote to memory of 4932 3568 cmd.exe 99 PID 4932 wrote to memory of 4312 4932 MPOKP.exe 100 PID 4312 wrote to memory of 3952 4312 cmd.exe 104 PID 3952 wrote to memory of 1688 3952 JHQVT.exe 105 PID 1688 wrote to memory of 440 1688 cmd.exe 109 PID 440 wrote to memory of 5940 440 ESG.exe 110 PID 5940 wrote to memory of 5788 5940 cmd.exe 114 PID 5788 wrote to memory of 1300 5788 MYLSSAO.exe 115 PID 1300 wrote to memory of 5096 1300 cmd.exe 119 PID 5096 wrote to memory of 4988 5096 QOSAE.exe 120 PID 4988 wrote to memory of 1640 4988 cmd.exe 124 PID 1640 wrote to memory of 1268 1640 GEB.exe 125 PID 1268 wrote to memory of 4460 1268 cmd.exe 129 PID 4460 wrote to memory of 3896 4460 PEVE.exe 130 PID 3896 wrote to memory of 5724 3896 cmd.exe 134 PID 5724 wrote to memory of 2604 5724 CPLV.exe 135 PID 2604 wrote to memory of 4180 2604 cmd.exe 139 PID 4180 wrote to memory of 3484 4180 GXSDGGL.exe 140 PID 3484 wrote to memory of 2092 3484 cmd.exe 144 PID 2092 wrote to memory of 4336 2092 XFU.exe 145 PID 4336 wrote to memory of 5704 4336 cmd.exe 149 PID 5188 wrote to memory of 1404 5188 cmd.exe 154 PID 1404 wrote to memory of 4360 1404 HJMJKTR.exe 155 PID 4360 wrote to memory of 1356 4360 cmd.exe 159 PID 1356 wrote to memory of 2780 1356 TZTJ.exe 160 PID 2780 wrote to memory of 5996 2780 cmd.exe 164 PID 5996 wrote to memory of 4308 5996 OHBGDX.exe 165 PID 4308 wrote to memory of 124 4308 cmd.exe 169 PID 124 wrote to memory of 2248 124 JSKE.exe 170 PID 2248 wrote to memory of 3800 2248 cmd.exe 174 PID 3800 wrote to memory of 1736 3800 HFJF.exe 175 PID 1736 wrote to memory of 1856 1736 cmd.exe 179 PID 1856 wrote to memory of 3004 1856 DQRE.exe 180 PID 3004 wrote to memory of 4208 3004 cmd.exe 184 PID 4208 wrote to memory of 4212 4208 KGSVJJ.exe 185 PID 4212 wrote to memory of 4688 4212 cmd.exe 189 PID 4688 wrote to memory of 4700 4688 FRJUXU.exe 190 PID 4700 wrote to memory of 3576 4700 cmd.exe 194 PID 3576 wrote to memory of 2884 3576 NHKLWHO.exe 195 PID 2884 wrote to memory of 4828 2884 cmd.exe 199 PID 4828 wrote to memory of 5416 4828 TWV.exe 200 PID 5416 wrote to memory of 5336 5416 cmd.exe 204 PID 5336 wrote to memory of 616 5336 XZT.exe 205 PID 616 wrote to memory of 4216 616 cmd.exe 209 PID 4216 wrote to memory of 2972 4216 ECLOCB.exe 210 PID 2972 wrote to memory of 2760 2972 cmd.exe 214 PID 2760 wrote to memory of 2560 2760 QKROOL.exe 215 PID 2560 wrote to memory of 1692 2560 cmd.exe 219 PID 1692 wrote to memory of 4324 1692 LYW.exe 220 PID 4324 wrote to memory of 5772 4324 cmd.exe 224 PID 5772 wrote to memory of 4848 5772 EBAB.exe 225 PID 4848 wrote to memory of 2876 4848 cmd.exe 229 PID 2876 wrote to memory of 244 2876 VJCGPG.exe 230 PID 244 wrote to memory of 1672 244 cmd.exe 233 PID 1672 wrote to memory of 5972 1672 BJK.exe 235 PID 5972 wrote to memory of 1136 5972 cmd.exe 239 PID 1136 wrote to memory of 3092 1136 VXODI.exe 240 PID 3092 wrote to memory of 4524 3092 cmd.exe 244 PID 4524 wrote to memory of 1488 4524 UHRT.exe 245 PID 1488 wrote to memory of 5196 1488 cmd.exe 249 PID 5196 wrote to memory of 1204 5196 NLVXWE.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_71f76e459973df0970c61f465a53ecab_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\SysWOW64\DRU.exeC:\windows\system32\DRU.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPOKP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\windows\system\MPOKP.exeC:\windows\system\MPOKP.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHQVT.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\system\JHQVT.exeC:\windows\system\JHQVT.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESG.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\system\ESG.exeC:\windows\system\ESG.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYLSSAO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\system\MYLSSAO.exeC:\windows\system\MYLSSAO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOSAE.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\SysWOW64\QOSAE.exeC:\windows\system32\QOSAE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEB.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\GEB.exeC:\windows\GEB.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEVE.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\system\PEVE.exeC:\windows\system\PEVE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPLV.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\CPLV.exeC:\windows\CPLV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXSDGGL.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\SysWOW64\GXSDGGL.exeC:\windows\system32\GXSDGGL.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFU.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\SysWOW64\XFU.exeC:\windows\system32\XFU.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGVKWIW.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\UGVKWIW.exeC:\windows\UGVKWIW.exe25⤵
- Executes dropped EXE
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJMJKTR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\SysWOW64\HJMJKTR.exeC:\windows\system32\HJMJKTR.exe27⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZTJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\TZTJ.exeC:\windows\system32\TZTJ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHBGDX.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\system\OHBGDX.exeC:\windows\system\OHBGDX.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSKE.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\SysWOW64\JSKE.exeC:\windows\system32\JSKE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFJF.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\SysWOW64\HFJF.exeC:\windows\system32\HFJF.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQRE.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\system\DQRE.exeC:\windows\system\DQRE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGSVJJ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\KGSVJJ.exeC:\windows\system\KGSVJJ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRJUXU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\FRJUXU.exeC:\windows\FRJUXU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHKLWHO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\system\NHKLWHO.exeC:\windows\system\NHKLWHO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWV.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\SysWOW64\TWV.exeC:\windows\system32\TWV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\system\XZT.exeC:\windows\system\XZT.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLOCB.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\system\ECLOCB.exeC:\windows\system\ECLOCB.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKROOL.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\SysWOW64\QKROOL.exeC:\windows\system32\QKROOL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYW.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\system\LYW.exeC:\windows\system\LYW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBAB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\system\EBAB.exeC:\windows\system\EBAB.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJK.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\BJK.exeC:\windows\BJK.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXODI.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\SysWOW64\VXODI.exeC:\windows\system32\VXODI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\windows\UHRT.exeC:\windows\UHRT.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDKIGF.exe.bat" "66⤵PID:1204
-
C:\windows\GDKIGF.exeC:\windows\GDKIGF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTLZ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\windows\SysWOW64\VTLZ.exeC:\windows\system32\VTLZ.exe69⤵
- Executes dropped EXE
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBSHZLC.exe.bat" "70⤵PID:2888
-
C:\windows\ZBSHZLC.exeC:\windows\ZBSHZLC.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRTYF.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5008 -
C:\windows\SysWOW64\PRTYF.exeC:\windows\system32\PRTYF.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPE.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3000 -
C:\windows\SysWOW64\NPE.exeC:\windows\system32\NPE.exe75⤵
- Executes dropped EXE
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "76⤵PID:2196
-
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYVMJ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3208 -
C:\windows\system\OYVMJ.exeC:\windows\system\OYVMJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4132 -
C:\windows\DOW.exeC:\windows\DOW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "82⤵PID:2800
-
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5212 -
C:\windows\IZO.exeC:\windows\IZO.exe85⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJX.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\SysWOW64\VJX.exeC:\windows\system32\VJX.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "88⤵PID:5340
-
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe89⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "90⤵PID:4148
-
C:\windows\NXD.exeC:\windows\NXD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYFWN.exe.bat" "92⤵PID:1668
-
C:\windows\SysWOW64\EYFWN.exeC:\windows\system32\EYFWN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYNKEKM.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4948 -
C:\windows\SysWOW64\CYNKEKM.exeC:\windows\system32\CYNKEKM.exe95⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEU.exe.bat" "98⤵PID:4372
-
C:\windows\SysWOW64\VEU.exeC:\windows\system32\VEU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1328 -
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe101⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4908 -
C:\windows\LCQ.exeC:\windows\LCQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe105⤵
- Executes dropped EXE
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5424 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe107⤵
- Executes dropped EXE
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "108⤵PID:1284
-
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3548 -
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1072 -
C:\windows\QGNH.exeC:\windows\QGNH.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "116⤵PID:2352
-
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "118⤵PID:2576
-
C:\windows\system\FUP.exeC:\windows\system\FUP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "120⤵PID:4488
-
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-