Analysis
- max time kernel
98s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe
- Size 208KB
- Sample260907-a54sdatwaz
- SHA256 2d67501d6d9a1998c20abfa69155c960521f7d5b9ddf05b3918b8da02b59d96e
- MD5 7507b33ca4ed2240a8a4011c5c7e3b0e
- SHA1 666ea333e7258eeacf06681ba104e23fb7a6f724
- SHA512 bb1044c7c7de00e789a62a4fe9c6a1fa984ee69cc2efe17abeb789b62586b1ea24149b565c74d224b66ddba03adcc9e76a5ae701620dacf06b4e456eedd6c889
- SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfG4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LO+kEj1
- TLSH T192247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2328 PLBLU.exe 6080 AOAF.exe 4212 KMGAPIA.exe 5580 FZLJ.exe 3144 LASXIK.exe 468 LFSLJP.exe 3836 AACQ.exe 2928 VWHZFK.exe 3420 PJL.exe 3176 XPEX.exe 5744 SCIGB.exe 3696 WSX.exe 1468 HKSH.exe 1168 NLAVEQ.exe 1076 WLC.exe 1512 CLJOR.exe 5456 CZJCSD.exe 5236 XMOLCDO.exe 1120 ZALV.exe 1780 XATJWX.exe 2468 DAAW.exe 4904 ZGG.exe 1548 UTLDE.exe 4188 PGQMGIL.exe 3272 AZT.exe 1348 IMLT.exe 4584 DAQDAV.exe 2000 CKYEOH.exe 4636 XYD.exe 4812 DYLBH.exe 3692 XTQLKBL.exe 4372 PTSQV.exe 2348 AMNJ.exe 460 LFQBE.exe 3340 KCBE.exe 3424 IQAFVDI.exe 5840 KLF.exe 5452 ILNCPF.exe 1860 OMUQGZ.exe 4408 JZZ.exe 2804 URCS.exe 5560 WPVUW.exe 2996 LKF.exe 4968 TQF.exe 5336 ODKXT.exe 4564 STQXFVZ.exe 1128 YUYKO.exe 6060 WHXTT.exe 5940 SMDIACS.exe 2852 JAN.exe 4916 LYHC.exe 3156 XQKVX.exe 3964 CQRJGFN.exe 3412 ARZX.exe 4664 VEWGHZ.exe 5928 GXZZH.exe 628 DCEWOQM.exe 5904 OVH.exe 5060 UVHCG.exe 1604 LGFSNV.exe 5544 JWRV.exe 3196 RBRKC.exe 4824 MWWTMMY.exe 3756 XPZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WKUMM.exe HMO.exe File created C:\windows\SysWOW64\ZUXTGA.exe ZPFNXN.exe File opened for modification C:\windows\SysWOW64\ZUXTGA.exe ZPFNXN.exe File created C:\windows\SysWOW64\HBOULF.exe YBMG.exe File created C:\windows\SysWOW64\IMLT.exe AZT.exe File opened for modification C:\windows\SysWOW64\DAQDAV.exe IMLT.exe File created C:\windows\SysWOW64\AMNJ.exe PTSQV.exe File created C:\windows\SysWOW64\OMUQGZ.exe.bat ILNCPF.exe File created C:\windows\SysWOW64\JAN.exe.bat SMDIACS.exe File opened for modification C:\windows\SysWOW64\FVEH.exe ZUXTGA.exe File created C:\windows\SysWOW64\UVHCG.exe.bat OVH.exe File opened for modification C:\windows\SysWOW64\IGF.exe TQEM.exe File created C:\windows\SysWOW64\HHBAM.exe MMW.exe File created C:\windows\SysWOW64\ZPFNXN.exe NHQ.exe File created C:\windows\SysWOW64\HBOULF.exe.bat YBMG.exe File created C:\windows\SysWOW64\AOAF.exe PLBLU.exe File opened for modification C:\windows\SysWOW64\PGQMGIL.exe UTLDE.exe File opened for modification C:\windows\SysWOW64\NDAU.exe RFCX.exe File opened for modification C:\windows\SysWOW64\TQIWLXI.exe XLCZENO.exe File opened for modification C:\windows\SysWOW64\HHBAM.exe MMW.exe File opened for modification C:\windows\SysWOW64\VWHZFK.exe AACQ.exe File created C:\windows\SysWOW64\WSX.exe.bat SCIGB.exe File created C:\windows\SysWOW64\IMLT.exe.bat AZT.exe File opened for modification C:\windows\SysWOW64\RFCX.exe RRC.exe File created C:\windows\SysWOW64\ULCS.exe.bat LDI.exe File opened for modification C:\windows\SysWOW64\HBOULF.exe YBMG.exe File created C:\windows\SysWOW64\ZALV.exe XMOLCDO.exe File created C:\windows\SysWOW64\SMDIACS.exe WHXTT.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat GXZZH.exe File created C:\windows\SysWOW64\IGF.exe.bat TQEM.exe File opened for modification C:\windows\SysWOW64\ULCS.exe LDI.exe File created C:\windows\SysWOW64\MENZDRP.exe.bat MRMKBEV.exe File created C:\windows\SysWOW64\FVEH.exe.bat ZUXTGA.exe File created C:\windows\SysWOW64\VWHZFK.exe.bat AACQ.exe File created C:\windows\SysWOW64\NDAU.exe RFCX.exe File opened for modification C:\windows\SysWOW64\XLEOKFF.exe PFLAIS.exe File created C:\windows\SysWOW64\HHBAM.exe.bat MMW.exe File opened for modification C:\windows\SysWOW64\ZALV.exe XMOLCDO.exe File opened for modification C:\windows\SysWOW64\CQRJGFN.exe XQKVX.exe File created C:\windows\SysWOW64\OMUQGZ.exe ILNCPF.exe File created C:\windows\SysWOW64\TQIWLXI.exe XLCZENO.exe File opened for modification C:\windows\SysWOW64\WLC.exe NLAVEQ.exe File created C:\windows\SysWOW64\ZALV.exe.bat XMOLCDO.exe File created C:\windows\SysWOW64\PGQMGIL.exe UTLDE.exe File opened for modification C:\windows\SysWOW64\OSKMRI.exe ISCY.exe File created C:\windows\SysWOW64\NDAU.exe.bat RFCX.exe File created C:\windows\SysWOW64\FVEH.exe ZUXTGA.exe File created C:\windows\SysWOW64\WSX.exe SCIGB.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe CZJCSD.exe File created C:\windows\SysWOW64\SMDIACS.exe.bat WHXTT.exe File created C:\windows\SysWOW64\JAN.exe SMDIACS.exe File opened for modification C:\windows\SysWOW64\IGP.exe OSKMRI.exe File created C:\windows\SysWOW64\SCIGB.exe XPEX.exe File opened for modification C:\windows\SysWOW64\HKSH.exe WSX.exe File opened for modification C:\windows\SysWOW64\EIVUBU.exe TPSB.exe File created C:\windows\SysWOW64\SAWTUR.exe HHBAM.exe File created C:\windows\SysWOW64\DAQDAV.exe.bat IMLT.exe File created C:\windows\SysWOW64\RFCX.exe RRC.exe File opened for modification C:\windows\SysWOW64\BBQP.exe TQIWLXI.exe File created C:\windows\SysWOW64\PYCQBA.exe SAWTUR.exe File created C:\windows\SysWOW64\VQTXIPW.exe.bat CXEMYOO.exe File created C:\windows\SysWOW64\HKSH.exe WSX.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat CZJCSD.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe ODKXT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\PNEIATK.exe.bat JNWVJR.exe File created C:\windows\system\MRMKBEV.exe ULCS.exe File opened for modification C:\windows\system\PLBLU.exe 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe File created C:\windows\system\DAAW.exe XATJWX.exe File created C:\windows\system\ILNCPF.exe.bat KLF.exe File created C:\windows\system\AMSQU.exe.bat YOYWWHL.exe File opened for modification C:\windows\OSUST.exe ISM.exe File created C:\windows\system\YBMG.exe XYI.exe File created C:\windows\system\PTSQV.exe XTQLKBL.exe File created C:\windows\HHDH.exe.bat XZJ.exe File created C:\windows\ODKXT.exe TQF.exe File created C:\windows\MWWTMMY.exe RBRKC.exe File created C:\windows\system\SAB.exe.bat OSUST.exe File created C:\windows\HHDH.exe XZJ.exe File opened for modification C:\windows\HHDH.exe XZJ.exe File created C:\windows\system\NLAVEQ.exe.bat HKSH.exe File created C:\windows\system\JZZ.exe.bat OMUQGZ.exe File opened for modification C:\windows\YUYKO.exe STQXFVZ.exe File created C:\windows\system\YBMG.exe.bat XYI.exe File opened for modification C:\windows\system\PTSQV.exe XTQLKBL.exe File created C:\windows\system\FZLJ.exe KMGAPIA.exe File created C:\windows\IQAFVDI.exe KCBE.exe File created C:\windows\XPZ.exe MWWTMMY.exe File created C:\windows\system\AORI.exe IGP.exe File opened for modification C:\windows\system\PFLAIS.exe LXFA.exe File created C:\windows\system\LRV.exe HBOULF.exe File created C:\windows\system\CLJOR.exe WLC.exe File opened for modification C:\windows\system\CLJOR.exe WLC.exe File opened for modification C:\windows\system\ILNCPF.exe KLF.exe File created C:\windows\system\WHXTT.exe.bat YUYKO.exe File created C:\windows\CYGMM.exe.bat SAB.exe File opened for modification C:\windows\TPSB.exe WKUMM.exe File opened for modification C:\windows\system\MRMKBEV.exe ULCS.exe File opened for modification C:\windows\AACQ.exe LFSLJP.exe File created C:\windows\CKYEOH.exe.bat DAQDAV.exe File created C:\windows\WPVUW.exe URCS.exe File created C:\windows\system\MTK.exe PNEIATK.exe File opened for modification C:\windows\system\MMW.exe KWV.exe File created C:\windows\YUYKO.exe STQXFVZ.exe File created C:\windows\system\XLCZENO.exe NDAU.exe File created C:\windows\system\HMO.exe.bat NRJFVU.exe File created C:\windows\TPSB.exe.bat WKUMM.exe File created C:\windows\system\PNEIATK.exe JNWVJR.exe File opened for modification C:\windows\UNV.exe AZQSMR.exe File created C:\windows\JNWVJR.exe PASLG.exe File created C:\windows\system\DYLBH.exe.bat XYD.exe File created C:\windows\system\GUJE.exe XPZ.exe File opened for modification C:\windows\system\GUJE.exe XPZ.exe File created C:\windows\OSUST.exe.bat ISM.exe File created C:\windows\system\MRMKBEV.exe.bat ULCS.exe File created C:\windows\system\LYHC.exe.bat JAN.exe File created C:\windows\AACQ.exe.bat LFSLJP.exe File opened for modification C:\windows\CKYEOH.exe DAQDAV.exe File created C:\windows\system\ILNCPF.exe KLF.exe File opened for modification C:\windows\URCS.exe JZZ.exe File opened for modification C:\windows\system\WHXTT.exe YUYKO.exe File created C:\windows\KMGAPIA.exe.bat AOAF.exe File created C:\windows\system\PFLAIS.exe.bat LXFA.exe File created C:\windows\OLXB.exe.bat VQTXIPW.exe File opened for modification C:\windows\system\LRV.exe HBOULF.exe File created C:\windows\system\XZJ.exe.bat LRV.exe File created C:\windows\system\FZLJ.exe.bat KMGAPIA.exe File opened for modification C:\windows\system\XLCZENO.exe NDAU.exe File created C:\windows\XYI.exe.bat FVEH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5964 cmd.exe 2008 cmd.exe 2232 cmd.exe 5956 cmd.exe 4428 cmd.exe 4732 cmd.exe 2776 cmd.exe 4796 cmd.exe 2732 cmd.exe 4260 cmd.exe 3252 cmd.exe 1236 cmd.exe 4476 cmd.exe 1344 cmd.exe 4484 cmd.exe 1552 cmd.exe 4184 cmd.exe 6024 cmd.exe 4752 cmd.exe 5716 cmd.exe 5524 cmd.exe 5736 cmd.exe 5068 cmd.exe 5308 cmd.exe 248 cmd.exe 1984 cmd.exe 3744 cmd.exe 4900 cmd.exe 3888 cmd.exe 3096 cmd.exe 3396 cmd.exe 5328 cmd.exe 3856 cmd.exe 3952 cmd.exe 1232 cmd.exe 2096 cmd.exe 4448 cmd.exe 3376 cmd.exe 4396 cmd.exe 2140 cmd.exe 3108 cmd.exe 6008 cmd.exe 1876 cmd.exe 6068 cmd.exe 3668 cmd.exe 4320 cmd.exe 3248 cmd.exe 4264 cmd.exe 5760 cmd.exe 1556 cmd.exe 4568 cmd.exe 3600 cmd.exe 4160 cmd.exe 5324 cmd.exe 6112 cmd.exe 996 cmd.exe 5844 cmd.exe 920 cmd.exe 5988 cmd.exe 5876 cmd.exe 3488 cmd.exe 4456 cmd.exe 2064 cmd.exe 904 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2916 3228 WerFault.exe 87 1748 2328 WerFault.exe 92 3404 6080 WerFault.exe 99 1764 4212 WerFault.exe 104 6088 5580 WerFault.exe 109 2728 3144 WerFault.exe 114 1204 468 WerFault.exe 119 2736 3836 WerFault.exe 124 2940 2928 WerFault.exe 129 1084 3420 WerFault.exe 134 5776 3176 WerFault.exe 139 5672 5744 WerFault.exe 144 2924 3696 WerFault.exe 149 2572 1468 WerFault.exe 154 3064 1168 WerFault.exe 159 2092 1076 WerFault.exe 164 4744 1512 WerFault.exe 169 4588 5456 WerFault.exe 174 2940 5236 WerFault.exe 179 1836 1120 WerFault.exe 184 5920 1780 WerFault.exe 189 5672 2468 WerFault.exe 194 2924 4904 WerFault.exe 199 1884 1548 WerFault.exe 204 2932 4188 WerFault.exe 209 5988 3272 WerFault.exe 214 4832 1348 WerFault.exe 219 3732 4584 WerFault.exe 224 4884 2000 WerFault.exe 229 4316 4636 WerFault.exe 234 3504 4812 WerFault.exe 239 1948 3692 WerFault.exe 244 2132 4372 WerFault.exe 249 1920 2348 WerFault.exe 254 4964 460 WerFault.exe 259 4868 3340 WerFault.exe 264 4900 3424 WerFault.exe 269 1252 5840 WerFault.exe 274 3248 5452 WerFault.exe 279 3520 1860 WerFault.exe 284 3432 4408 WerFault.exe 290 3728 2804 WerFault.exe 295 2684 5560 WerFault.exe 300 4660 2996 WerFault.exe 305 2028 4968 WerFault.exe 310 4192 5336 WerFault.exe 315 6116 4564 WerFault.exe 320 4000 1128 WerFault.exe 325 5308 6060 WerFault.exe 330 1228 5940 WerFault.exe 335 1748 2852 WerFault.exe 340 2616 4916 WerFault.exe 345 2064 3156 WerFault.exe 350 2540 3964 WerFault.exe 355 2164 3412 WerFault.exe 360 6116 4664 WerFault.exe 365 1288 5928 WerFault.exe 370 4488 628 WerFault.exe 375 3444 5904 WerFault.exe 380 4956 5060 WerFault.exe 385 3764 1604 WerFault.exe 390 4148 5544 WerFault.exe 395 3472 3196 WerFault.exe 400 1460 4824 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSUST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMDIACS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQTXIPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEWGHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPVUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMSQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIVUBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYCQBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQIWLXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MENZDRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRJFVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWHZFK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe 3228 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe 2328 PLBLU.exe 2328 PLBLU.exe 6080 AOAF.exe 6080 AOAF.exe 4212 KMGAPIA.exe 4212 KMGAPIA.exe 5580 FZLJ.exe 5580 FZLJ.exe 3144 LASXIK.exe 3144 LASXIK.exe 468 LFSLJP.exe 468 LFSLJP.exe 3836 AACQ.exe 3836 AACQ.exe 2928 VWHZFK.exe 2928 VWHZFK.exe 3420 PJL.exe 3420 PJL.exe 3176 XPEX.exe 3176 XPEX.exe 5744 SCIGB.exe 5744 SCIGB.exe 3696 WSX.exe 3696 WSX.exe 1468 HKSH.exe 1468 HKSH.exe 1168 NLAVEQ.exe 1168 NLAVEQ.exe 1076 WLC.exe 1076 WLC.exe 1512 CLJOR.exe 1512 CLJOR.exe 5456 CZJCSD.exe 5456 CZJCSD.exe 5236 XMOLCDO.exe 5236 XMOLCDO.exe 1120 ZALV.exe 1120 ZALV.exe 1780 XATJWX.exe 1780 XATJWX.exe 2468 DAAW.exe 2468 DAAW.exe 4904 ZGG.exe 4904 ZGG.exe 1548 UTLDE.exe 1548 UTLDE.exe 4188 PGQMGIL.exe 4188 PGQMGIL.exe 3272 AZT.exe 3272 AZT.exe 1348 IMLT.exe 1348 IMLT.exe 4584 DAQDAV.exe 4584 DAQDAV.exe 2000 CKYEOH.exe 2000 CKYEOH.exe 4636 XYD.exe 4636 XYD.exe 4812 DYLBH.exe 4812 DYLBH.exe 3692 XTQLKBL.exe 3692 XTQLKBL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3228 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe 3228 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe 2328 PLBLU.exe 2328 PLBLU.exe 6080 AOAF.exe 6080 AOAF.exe 4212 KMGAPIA.exe 4212 KMGAPIA.exe 5580 FZLJ.exe 5580 FZLJ.exe 3144 LASXIK.exe 3144 LASXIK.exe 468 LFSLJP.exe 468 LFSLJP.exe 3836 AACQ.exe 3836 AACQ.exe 2928 VWHZFK.exe 2928 VWHZFK.exe 3420 PJL.exe 3420 PJL.exe 3176 XPEX.exe 3176 XPEX.exe 5744 SCIGB.exe 5744 SCIGB.exe 3696 WSX.exe 3696 WSX.exe 1468 HKSH.exe 1468 HKSH.exe 1168 NLAVEQ.exe 1168 NLAVEQ.exe 1076 WLC.exe 1076 WLC.exe 1512 CLJOR.exe 1512 CLJOR.exe 5456 CZJCSD.exe 5456 CZJCSD.exe 5236 XMOLCDO.exe 5236 XMOLCDO.exe 1120 ZALV.exe 1120 ZALV.exe 1780 XATJWX.exe 1780 XATJWX.exe 2468 DAAW.exe 2468 DAAW.exe 4904 ZGG.exe 4904 ZGG.exe 1548 UTLDE.exe 1548 UTLDE.exe 4188 PGQMGIL.exe 4188 PGQMGIL.exe 3272 AZT.exe 3272 AZT.exe 1348 IMLT.exe 1348 IMLT.exe 4584 DAQDAV.exe 4584 DAQDAV.exe 2000 CKYEOH.exe 2000 CKYEOH.exe 4636 XYD.exe 4636 XYD.exe 4812 DYLBH.exe 4812 DYLBH.exe 3692 XTQLKBL.exe 3692 XTQLKBL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3228 wrote to memory of 3096 3228 2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe 89 PID 3096 wrote to memory of 2328 3096 cmd.exe 92 PID 2328 wrote to memory of 2776 2328 PLBLU.exe 95 PID 2776 wrote to memory of 6080 2776 cmd.exe 99 PID 6080 wrote to memory of 5736 6080 AOAF.exe 100 PID 5736 wrote to memory of 4212 5736 cmd.exe 104 PID 4212 wrote to memory of 3624 4212 KMGAPIA.exe 105 PID 3624 wrote to memory of 5580 3624 cmd.exe 109 PID 5580 wrote to memory of 996 5580 FZLJ.exe 110 PID 996 wrote to memory of 3144 996 cmd.exe 114 PID 3144 wrote to memory of 2264 3144 LASXIK.exe 115 PID 2264 wrote to memory of 468 2264 cmd.exe 119 PID 468 wrote to memory of 3488 468 LFSLJP.exe 120 PID 3488 wrote to memory of 3836 3488 cmd.exe 124 PID 3836 wrote to memory of 5004 3836 AACQ.exe 125 PID 5004 wrote to memory of 2928 5004 cmd.exe 129 PID 2928 wrote to memory of 4320 2928 VWHZFK.exe 130 PID 4320 wrote to memory of 3420 4320 cmd.exe 134 PID 3420 wrote to memory of 4672 3420 PJL.exe 135 PID 4672 wrote to memory of 3176 4672 cmd.exe 139 PID 3176 wrote to memory of 3820 3176 XPEX.exe 140 PID 3820 wrote to memory of 5744 3820 cmd.exe 144 PID 5744 wrote to memory of 1260 5744 SCIGB.exe 145 PID 1260 wrote to memory of 3696 1260 cmd.exe 149 PID 3696 wrote to memory of 5948 3696 WSX.exe 150 PID 5948 wrote to memory of 1468 5948 cmd.exe 154 PID 1468 wrote to memory of 2508 1468 HKSH.exe 155 PID 2508 wrote to memory of 1168 2508 cmd.exe 159 PID 1168 wrote to memory of 2044 1168 NLAVEQ.exe 160 PID 2044 wrote to memory of 1076 2044 cmd.exe 164 PID 1076 wrote to memory of 5532 1076 WLC.exe 165 PID 5532 wrote to memory of 1512 5532 cmd.exe 169 PID 1512 wrote to memory of 4924 1512 CLJOR.exe 170 PID 4924 wrote to memory of 5456 4924 cmd.exe 174 PID 5456 wrote to memory of 828 5456 CZJCSD.exe 175 PID 828 wrote to memory of 5236 828 cmd.exe 179 PID 5236 wrote to memory of 4280 5236 XMOLCDO.exe 180 PID 4280 wrote to memory of 1120 4280 cmd.exe 184 PID 1120 wrote to memory of 4480 1120 ZALV.exe 185 PID 4480 wrote to memory of 1780 4480 cmd.exe 189 PID 1780 wrote to memory of 1840 1780 XATJWX.exe 190 PID 1840 wrote to memory of 2468 1840 cmd.exe 194 PID 2468 wrote to memory of 3396 2468 DAAW.exe 195 PID 3396 wrote to memory of 4904 3396 cmd.exe 199 PID 4904 wrote to memory of 4160 4904 ZGG.exe 200 PID 4160 wrote to memory of 1548 4160 cmd.exe 204 PID 1548 wrote to memory of 4932 1548 UTLDE.exe 205 PID 4932 wrote to memory of 4188 4932 cmd.exe 209 PID 4188 wrote to memory of 4456 4188 PGQMGIL.exe 210 PID 4456 wrote to memory of 3272 4456 cmd.exe 214 PID 3272 wrote to memory of 4348 3272 AZT.exe 215 PID 4348 wrote to memory of 1348 4348 cmd.exe 219 PID 1348 wrote to memory of 692 1348 IMLT.exe 220 PID 692 wrote to memory of 4584 692 cmd.exe 224 PID 4584 wrote to memory of 2736 4584 DAQDAV.exe 225 PID 2736 wrote to memory of 2000 2736 cmd.exe 229 PID 2000 wrote to memory of 2692 2000 CKYEOH.exe 230 PID 2692 wrote to memory of 4636 2692 cmd.exe 234 PID 4636 wrote to memory of 1280 4636 XYD.exe 235 PID 1280 wrote to memory of 4812 1280 cmd.exe 239 PID 4812 wrote to memory of 5708 4812 DYLBH.exe 240 PID 5708 wrote to memory of 3692 5708 cmd.exe 244 PID 3692 wrote to memory of 1776 3692 XTQLKBL.exe 245 PID 1776 wrote to memory of 4372 1776 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_7507b33ca4ed2240a8a4011c5c7e3b0e_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOAF.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\AOAF.exeC:\windows\system32\AOAF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFSLJP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\LFSLJP.exeC:\windows\system\LFSLJP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\AACQ.exeC:\windows\AACQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWHZFK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\SysWOW64\VWHZFK.exeC:\windows\system32\VWHZFK.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJL.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\PJL.exeC:\windows\PJL.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPEX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\system\XPEX.exeC:\windows\system\XPEX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\CZJCSD.exeC:\windows\CZJCSD.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\XATJWX.exeC:\windows\XATJWX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAAW.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\system\DAAW.exeC:\windows\system\DAAW.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZT.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\AZT.exeC:\windows\system\AZT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMLT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\SysWOW64\IMLT.exeC:\windows\system32\IMLT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DAQDAV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\SysWOW64\DAQDAV.exeC:\windows\system32\DAQDAV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYD.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\SysWOW64\XYD.exeC:\windows\system32\XYD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLBH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\system\DYLBH.exeC:\windows\system\DYLBH.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTSQV.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\PTSQV.exeC:\windows\system\PTSQV.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMNJ.exe.bat" "66⤵PID:6000
-
C:\windows\SysWOW64\AMNJ.exeC:\windows\system32\AMNJ.exe67⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFQBE.exe.bat" "68⤵PID:4572
-
C:\windows\system\LFQBE.exeC:\windows\system\LFQBE.exe69⤵
- Executes dropped EXE
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCBE.exe.bat" "70⤵PID:5148
-
C:\windows\KCBE.exeC:\windows\KCBE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "72⤵PID:1972
-
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe73⤵
- Executes dropped EXE
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLF.exe.bat" "74⤵PID:3616
-
C:\windows\KLF.exeC:\windows\KLF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "76⤵PID:3236
-
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMUQGZ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5856 -
C:\windows\SysWOW64\OMUQGZ.exeC:\windows\system32\OMUQGZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZ.exe.bat" "80⤵PID:4552
-
C:\windows\system\JZZ.exeC:\windows\system\JZZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URCS.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4484 -
C:\windows\URCS.exeC:\windows\URCS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPVUW.exe.bat" "84⤵PID:1872
-
C:\windows\WPVUW.exeC:\windows\WPVUW.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKF.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\windows\LKF.exeC:\windows\LKF.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQF.exe.bat" "88⤵PID:5952
-
C:\windows\TQF.exeC:\windows\TQF.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODKXT.exe.bat" "90⤵PID:5040
-
C:\windows\ODKXT.exeC:\windows\ODKXT.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STQXFVZ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4376 -
C:\windows\SysWOW64\STQXFVZ.exeC:\windows\system32\STQXFVZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUYKO.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5068 -
C:\windows\YUYKO.exeC:\windows\YUYKO.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHXTT.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\system\WHXTT.exeC:\windows\system\WHXTT.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMDIACS.exe.bat" "98⤵PID:5796
-
C:\windows\SysWOW64\SMDIACS.exeC:\windows\system32\SMDIACS.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3520 -
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYHC.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3108 -
C:\windows\system\LYHC.exeC:\windows\system\LYHC.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQKVX.exe.bat" "104⤵PID:3468
-
C:\windows\XQKVX.exeC:\windows\XQKVX.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQRJGFN.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4184 -
C:\windows\SysWOW64\CQRJGFN.exeC:\windows\system32\CQRJGFN.exe107⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARZX.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1720 -
C:\windows\system\ARZX.exeC:\windows\system\ARZX.exe109⤵
- Executes dropped EXE
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEWGHZ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4796 -
C:\windows\SysWOW64\VEWGHZ.exeC:\windows\system32\VEWGHZ.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXZZH.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1892 -
C:\windows\system\GXZZH.exeC:\windows\system\GXZZH.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6008 -
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe115⤵
- Executes dropped EXE
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVH.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5844 -
C:\windows\system\OVH.exeC:\windows\system\OVH.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UVHCG.exe.bat" "118⤵PID:2844
-
C:\windows\SysWOW64\UVHCG.exeC:\windows\system32\UVHCG.exe119⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGFSNV.exe.bat" "120⤵PID:3988
-
C:\windows\system\LGFSNV.exeC:\windows\system\LGFSNV.exe121⤵
- Executes dropped EXE
PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-