Analysis
- max time kernel
91s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 08:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe
- Size 208KB
- Sample260910-kdthfazhlc
- SHA256 8f56b997c13944a55b3d3f7327024e6fbba633989d94b771ae970959b094c4e3
- MD5 fc22d5f2f0ce41e188b37fba708f4f7f
- SHA1 bbd2d18cb01ce8ad78a57008d944b1a474faa745
- SHA512 40b6bbbda2b3e87db928ec67418fe62ec13c5bf199ef3bae12fd02d00c72059c5aba98d8ab366f45d1cce87bd66de002c446059d132150adad31f28cacb6c3a9
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfX4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOPkEj1
- TLSH T1DB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1364 ATB.exe 6096 KMLAIIK.exe 3616 OUSI.exe 3748 ZMVTV.exe 4912 DDB.exe 2120 EYFWN.exe 1220 SDLTUR.exe 4672 YDTH.exe 5900 GJTW.exe 6040 UUBUAJF.exe 4144 FMEN.exe 5616 ZAJXL.exe 5696 DQQ.exe 5924 HYWFJ.exe 3764 SQZPSJ.exe 1200 COFKZR.exe 4504 CUFYBEM.exe 5412 XPC.exe 4800 SSSGZH.exe 3376 EKVZHWD.exe 4532 IACZM.exe 1392 RBEEXM.exe 1268 TOBOZ.exe 2944 QTTD.exe 4684 BMWWY.exe 5936 WHBFIOP.exe 4248 WNTTKBS.exe 4624 LIKGV.exe 1692 CQELYT.exe 5824 ZOK.exe 3292 KGNT.exe 5100 FCSKYK.exe 4500 OHDCNHO.exe 4160 QFWWUWW.exe 1316 BXZP.exe 4196 QSITNYM.exe 5960 CLLMNF.exe 1216 YQJJCPE.exe 2012 JJMC.exe 4900 TJOHO.exe 4436 ZKWVXWX.exe 5648 KCZ.exe 4908 OSFOKV.exe 6112 ZLAHSDP.exe 4308 FLIU.exe 6104 AYNELF.exe 2776 LRQWT.exe 5512 HXVUBWP.exe 2856 NXDH.exe 4760 ZPYAS.exe 3492 IQAFVDI.exe 3588 ZDLXLAW.exe 4876 BBM.exe 6044 HBTFA.exe 5584 FWLOFU.exe 1984 WCVG.exe 5812 HUYZV.exe 5692 CQDIFGU.exe 5972 NIGTON.exe 1992 KGE.exe 240 QGLEE.exe 1440 BZOWMG.exe 5448 KHQ.exe 800 HMWZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KGE.exe.bat NIGTON.exe File created C:\windows\SysWOW64\DSTM.exe TSR.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat FMEN.exe File created C:\windows\SysWOW64\KGE.exe NIGTON.exe File created C:\windows\SysWOW64\ZYZJKY.exe.bat DSTM.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat NWHE.exe File created C:\windows\SysWOW64\KJEK.exe ODG.exe File opened for modification C:\windows\SysWOW64\JFC.exe FXVN.exe File created C:\windows\SysWOW64\GGS.exe MTNHEF.exe File opened for modification C:\windows\SysWOW64\DSTCD.exe FHIMUW.exe File created C:\windows\SysWOW64\KMLAIIK.exe ATB.exe File created C:\windows\SysWOW64\KCZ.exe ZKWVXWX.exe File opened for modification C:\windows\SysWOW64\KCZ.exe ZKWVXWX.exe File created C:\windows\SysWOW64\OSFOKV.exe.bat KCZ.exe File created C:\windows\SysWOW64\CQDIFGU.exe HUYZV.exe File created C:\windows\SysWOW64\CQDIFGU.exe.bat HUYZV.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe DSTM.exe File created C:\windows\SysWOW64\ODG.exe TQBMUA.exe File opened for modification C:\windows\SysWOW64\WHBFIOP.exe BMWWY.exe File opened for modification C:\windows\SysWOW64\SDLTUR.exe EYFWN.exe File opened for modification C:\windows\SysWOW64\ZAJXL.exe FMEN.exe File created C:\windows\SysWOW64\AYNELF.exe FLIU.exe File opened for modification C:\windows\SysWOW64\AYNELF.exe FLIU.exe File created C:\windows\SysWOW64\ZXOZ.exe.bat BBPRCM.exe File created C:\windows\SysWOW64\JFC.exe FXVN.exe File created C:\windows\SysWOW64\SRRC.exe URJPMYF.exe File opened for modification C:\windows\SysWOW64\EYFWN.exe DDB.exe File opened for modification C:\windows\SysWOW64\KGNT.exe ZOK.exe File created C:\windows\SysWOW64\AYNELF.exe.bat FLIU.exe File created C:\windows\SysWOW64\KHQ.exe.bat BZOWMG.exe File created C:\windows\SysWOW64\SRRC.exe.bat URJPMYF.exe File opened for modification C:\windows\SysWOW64\CYI.exe CVEL.exe File created C:\windows\SysWOW64\CYI.exe.bat CVEL.exe File created C:\windows\SysWOW64\FLIU.exe ZLAHSDP.exe File created C:\windows\SysWOW64\FLIU.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\LGE.exe OBYWBW.exe File created C:\windows\SysWOW64\UYF.exe.bat JFC.exe File opened for modification C:\windows\SysWOW64\CPXP.exe SRRC.exe File created C:\windows\SysWOW64\CPXP.exe.bat SRRC.exe File created C:\windows\SysWOW64\KCZ.exe.bat ZKWVXWX.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe LGE.exe File created C:\windows\SysWOW64\ZXOZ.exe BBPRCM.exe File created C:\windows\SysWOW64\MMUKN.exe.bat DZKSXYE.exe File created C:\windows\SysWOW64\ZKWVXWX.exe TJOHO.exe File created C:\windows\SysWOW64\ZAJXL.exe FMEN.exe File opened for modification C:\windows\SysWOW64\KGE.exe NIGTON.exe File opened for modification C:\windows\SysWOW64\KHQ.exe BZOWMG.exe File opened for modification C:\windows\SysWOW64\ODG.exe TQBMUA.exe File created C:\windows\SysWOW64\KGNT.exe ZOK.exe File created C:\windows\SysWOW64\OSFOKV.exe KCZ.exe File opened for modification C:\windows\SysWOW64\DSTM.exe TSR.exe File opened for modification C:\windows\SysWOW64\FXVN.exe ZXOZ.exe File created C:\windows\SysWOW64\JFC.exe.bat FXVN.exe File created C:\windows\SysWOW64\GGS.exe.bat MTNHEF.exe File created C:\windows\SysWOW64\WHBFIOP.exe BMWWY.exe File created C:\windows\SysWOW64\KMLAIIK.exe.bat ATB.exe File created C:\windows\SysWOW64\EYFWN.exe DDB.exe File created C:\windows\SysWOW64\LGE.exe.bat OBYWBW.exe File created C:\windows\SysWOW64\IZWORJT.exe CZOAAH.exe File opened for modification C:\windows\SysWOW64\KJEK.exe ODG.exe File created C:\windows\SysWOW64\KJEK.exe.bat ODG.exe File created C:\windows\SysWOW64\CYI.exe CVEL.exe File created C:\windows\SysWOW64\CMOMYC.exe LGE.exe File created C:\windows\SysWOW64\HKMWSR.exe NWHE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\HYWFJ.exe DQQ.exe File created C:\windows\system\DKUW.exe HMWZ.exe File created C:\windows\YFFCSYF.exe.bat MPZCO.exe File opened for modification C:\windows\BXZP.exe QFWWUWW.exe File created C:\windows\MTNHEF.exe.bat VLLC.exe File opened for modification C:\windows\ZOK.exe CQELYT.exe File created C:\windows\system\OBYWBW.exe.bat JQCYWEX.exe File created C:\windows\system\VLLC.exe RDFCGPS.exe File created C:\windows\AXIR.exe WPCRBF.exe File created C:\windows\system\ATB.exe 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe File created C:\windows\system\IACZM.exe EKVZHWD.exe File created C:\windows\system\IACZM.exe.bat EKVZHWD.exe File created C:\windows\system\FWLOFU.exe HBTFA.exe File opened for modification C:\windows\system\XJVEEL.exe CWQU.exe File opened for modification C:\windows\FHIMUW.exe MEEI.exe File created C:\windows\EKVZHWD.exe SSSGZH.exe File created C:\windows\system\TJOHO.exe JJMC.exe File created C:\windows\system\HMWZ.exe KHQ.exe File created C:\windows\system\VTRDWLJ.exe.bat GOMGPJH.exe File created C:\windows\system\NGPVNY.exe.bat SSKL.exe File opened for modification C:\windows\system\IACZM.exe EKVZHWD.exe File opened for modification C:\windows\system\CZOAAH.exe CMOMYC.exe File created C:\windows\SSKL.exe.bat YFFCSYF.exe File created C:\windows\system\XPC.exe CUFYBEM.exe File created C:\windows\ZLAHSDP.exe.bat OSFOKV.exe File opened for modification C:\windows\system\DKUW.exe HMWZ.exe File created C:\windows\BNEC.exe.bat DMWPRA.exe File opened for modification C:\windows\YDTH.exe SDLTUR.exe File opened for modification C:\windows\system\ZPYAS.exe NXDH.exe File created C:\windows\AXIR.exe.bat WPCRBF.exe File created C:\windows\system\DQQ.exe.bat ZAJXL.exe File created C:\windows\system\DKUW.exe.bat HMWZ.exe File opened for modification C:\windows\QTTD.exe TOBOZ.exe File opened for modification C:\windows\BNEC.exe DMWPRA.exe File created C:\windows\FHIMUW.exe MEEI.exe File created C:\windows\system\VTMKK.exe CYI.exe File created C:\windows\system\OBYWBW.exe JQCYWEX.exe File opened for modification C:\windows\URJPMYF.exe AAMVSNG.exe File created C:\windows\system\DDB.exe.bat ZMVTV.exe File opened for modification C:\windows\system\GJTW.exe YDTH.exe File created C:\windows\system\LRQWT.exe AYNELF.exe File opened for modification C:\windows\system\QGLEE.exe KGE.exe File created C:\windows\OHDCNHO.exe.bat FCSKYK.exe File opened for modification C:\windows\system\MHAMX.exe GGS.exe File created C:\windows\system\AAMVSNG.exe AXIR.exe File created C:\windows\system\CUFYBEM.exe COFKZR.exe File created C:\windows\system\CUFYBEM.exe.bat COFKZR.exe File opened for modification C:\windows\QFWWUWW.exe OHDCNHO.exe File created C:\windows\system\HUYZV.exe WCVG.exe File created C:\windows\system\TSR.exe.bat IZWORJT.exe File created C:\windows\system\TQBMUA.exe.bat NPUQ.exe File created C:\windows\ZOK.exe CQELYT.exe File opened for modification C:\windows\system\JJMC.exe YQJJCPE.exe File created C:\windows\BBM.exe.bat ZDLXLAW.exe File opened for modification C:\windows\system\GOMGPJH.exe UYF.exe File created C:\windows\MEEI.exe XJVEEL.exe File opened for modification C:\windows\system\DDB.exe ZMVTV.exe File opened for modification C:\windows\system\WNTTKBS.exe WHBFIOP.exe File created C:\windows\OHDCNHO.exe FCSKYK.exe File created C:\windows\system\HBTFA.exe BBM.exe File created C:\windows\system\WCVG.exe FWLOFU.exe File created C:\windows\system\TSR.exe IZWORJT.exe File created C:\windows\system\WPCRBF.exe MHAMX.exe File created C:\windows\system\AAMVSNG.exe.bat AXIR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4180 cmd.exe 4336 cmd.exe 4668 cmd.exe 2424 cmd.exe 4640 cmd.exe 4360 cmd.exe 5816 cmd.exe 4176 cmd.exe 5364 cmd.exe 1492 cmd.exe 4128 cmd.exe 2344 cmd.exe 5080 cmd.exe 4216 cmd.exe 5068 cmd.exe 1884 cmd.exe 3200 cmd.exe 2328 cmd.exe 4352 cmd.exe 2404 cmd.exe 4276 cmd.exe 4408 cmd.exe 5164 cmd.exe 1516 cmd.exe 1348 cmd.exe 3152 cmd.exe 1936 cmd.exe 3380 cmd.exe 5592 cmd.exe 2272 cmd.exe 2444 cmd.exe 2044 cmd.exe 4468 cmd.exe 5152 cmd.exe 2720 cmd.exe 5556 cmd.exe 5196 cmd.exe 4508 cmd.exe 3028 cmd.exe 4388 cmd.exe 996 cmd.exe 5424 cmd.exe 5976 cmd.exe 4888 cmd.exe 2260 cmd.exe 5076 cmd.exe 4824 cmd.exe 2744 cmd.exe 3264 cmd.exe 1696 cmd.exe 1536 cmd.exe 3716 cmd.exe 4452 cmd.exe 4172 cmd.exe 2028 cmd.exe 2296 cmd.exe 4304 cmd.exe 2920 cmd.exe 3560 cmd.exe 4916 cmd.exe 3988 cmd.exe 1428 cmd.exe 4776 cmd.exe 1188 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5208 5672 WerFault.exe 88 1936 1364 WerFault.exe 93 3116 6096 WerFault.exe 99 1848 3616 WerFault.exe 104 4624 3748 WerFault.exe 109 2132 4912 WerFault.exe 114 2528 2120 WerFault.exe 119 2228 1220 WerFault.exe 124 5940 4672 WerFault.exe 129 3544 5900 WerFault.exe 134 4740 6040 WerFault.exe 139 4552 4144 WerFault.exe 144 1380 5616 WerFault.exe 149 1936 5696 WerFault.exe 154 1688 5924 WerFault.exe 159 5044 3764 WerFault.exe 164 2372 1200 WerFault.exe 169 5164 4504 WerFault.exe 174 2080 5412 WerFault.exe 179 2072 4800 WerFault.exe 184 4296 3376 WerFault.exe 189 124 4532 WerFault.exe 194 4924 1392 WerFault.exe 199 1348 1268 WerFault.exe 204 5184 2944 WerFault.exe 209 1908 4684 WerFault.exe 214 1904 5936 WerFault.exe 219 5512 4248 WerFault.exe 224 5432 4624 WerFault.exe 229 6140 1692 WerFault.exe 234 4844 5824 WerFault.exe 239 5020 3292 WerFault.exe 244 4264 5100 WerFault.exe 249 2328 4500 WerFault.exe 254 2496 4160 WerFault.exe 259 2636 1316 WerFault.exe 264 1584 4196 WerFault.exe 269 2076 5960 WerFault.exe 274 2064 1216 WerFault.exe 279 4560 2012 WerFault.exe 284 3836 4900 WerFault.exe 290 2896 4436 WerFault.exe 295 5800 5648 WerFault.exe 300 2328 4908 WerFault.exe 305 5228 6112 WerFault.exe 310 2704 4308 WerFault.exe 315 5520 6104 WerFault.exe 320 5688 2776 WerFault.exe 325 2680 5512 WerFault.exe 330 2720 2856 WerFault.exe 335 3836 4760 WerFault.exe 340 996 3492 WerFault.exe 345 5364 3588 WerFault.exe 350 5016 4876 WerFault.exe 355 4220 6044 WerFault.exe 360 1828 5584 WerFault.exe 365 3816 1984 WerFault.exe 370 248 5812 WerFault.exe 375 4716 5692 WerFault.exe 380 5284 5972 WerFault.exe 385 5920 1992 WerFault.exe 390 1360 240 WerFault.exe 395 1864 1440 WerFault.exe 400 2092 5448 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQELYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZKSXYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPCRBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGPVNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHBFIOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZWORJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSFOKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAJXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZOAAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBPRCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSITNYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDLTUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYNELF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDLXLAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYOKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CVEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQBMUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUFYBEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IACZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLLMNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLAHSDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQDIFGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5672 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe 5672 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe 1364 ATB.exe 1364 ATB.exe 6096 KMLAIIK.exe 6096 KMLAIIK.exe 3616 OUSI.exe 3616 OUSI.exe 3748 ZMVTV.exe 3748 ZMVTV.exe 4912 DDB.exe 4912 DDB.exe 2120 EYFWN.exe 2120 EYFWN.exe 1220 SDLTUR.exe 1220 SDLTUR.exe 4672 YDTH.exe 4672 YDTH.exe 5900 GJTW.exe 5900 GJTW.exe 6040 UUBUAJF.exe 6040 UUBUAJF.exe 4144 FMEN.exe 4144 FMEN.exe 5616 ZAJXL.exe 5616 ZAJXL.exe 5696 DQQ.exe 5696 DQQ.exe 5924 HYWFJ.exe 5924 HYWFJ.exe 3764 SQZPSJ.exe 3764 SQZPSJ.exe 1200 COFKZR.exe 1200 COFKZR.exe 4504 CUFYBEM.exe 4504 CUFYBEM.exe 5412 XPC.exe 5412 XPC.exe 4800 SSSGZH.exe 4800 SSSGZH.exe 3376 EKVZHWD.exe 3376 EKVZHWD.exe 4532 IACZM.exe 4532 IACZM.exe 1392 RBEEXM.exe 1392 RBEEXM.exe 1268 TOBOZ.exe 1268 TOBOZ.exe 2944 QTTD.exe 2944 QTTD.exe 4684 BMWWY.exe 4684 BMWWY.exe 5936 WHBFIOP.exe 5936 WHBFIOP.exe 4248 WNTTKBS.exe 4248 WNTTKBS.exe 4624 LIKGV.exe 4624 LIKGV.exe 1692 CQELYT.exe 1692 CQELYT.exe 5824 ZOK.exe 5824 ZOK.exe 3292 KGNT.exe 3292 KGNT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5672 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe 5672 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe 1364 ATB.exe 1364 ATB.exe 6096 KMLAIIK.exe 6096 KMLAIIK.exe 3616 OUSI.exe 3616 OUSI.exe 3748 ZMVTV.exe 3748 ZMVTV.exe 4912 DDB.exe 4912 DDB.exe 2120 EYFWN.exe 2120 EYFWN.exe 1220 SDLTUR.exe 1220 SDLTUR.exe 4672 YDTH.exe 4672 YDTH.exe 5900 GJTW.exe 5900 GJTW.exe 6040 UUBUAJF.exe 6040 UUBUAJF.exe 4144 FMEN.exe 4144 FMEN.exe 5616 ZAJXL.exe 5616 ZAJXL.exe 5696 DQQ.exe 5696 DQQ.exe 5924 HYWFJ.exe 5924 HYWFJ.exe 3764 SQZPSJ.exe 3764 SQZPSJ.exe 1200 COFKZR.exe 1200 COFKZR.exe 4504 CUFYBEM.exe 4504 CUFYBEM.exe 5412 XPC.exe 5412 XPC.exe 4800 SSSGZH.exe 4800 SSSGZH.exe 3376 EKVZHWD.exe 3376 EKVZHWD.exe 4532 IACZM.exe 4532 IACZM.exe 1392 RBEEXM.exe 1392 RBEEXM.exe 1268 TOBOZ.exe 1268 TOBOZ.exe 2944 QTTD.exe 2944 QTTD.exe 4684 BMWWY.exe 4684 BMWWY.exe 5936 WHBFIOP.exe 5936 WHBFIOP.exe 4248 WNTTKBS.exe 4248 WNTTKBS.exe 4624 LIKGV.exe 4624 LIKGV.exe 1692 CQELYT.exe 1692 CQELYT.exe 5824 ZOK.exe 5824 ZOK.exe 3292 KGNT.exe 3292 KGNT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5672 wrote to memory of 4176 5672 2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe 89 PID 4176 wrote to memory of 1364 4176 cmd.exe 93 PID 1364 wrote to memory of 6036 1364 ATB.exe 95 PID 6036 wrote to memory of 6096 6036 cmd.exe 99 PID 6096 wrote to memory of 4412 6096 KMLAIIK.exe 100 PID 4412 wrote to memory of 3616 4412 cmd.exe 104 PID 3616 wrote to memory of 5876 3616 OUSI.exe 105 PID 5876 wrote to memory of 3748 5876 cmd.exe 109 PID 3748 wrote to memory of 5176 3748 ZMVTV.exe 110 PID 5176 wrote to memory of 4912 5176 cmd.exe 114 PID 4912 wrote to memory of 2344 4912 DDB.exe 115 PID 2344 wrote to memory of 2120 2344 cmd.exe 119 PID 2120 wrote to memory of 1328 2120 EYFWN.exe 120 PID 1328 wrote to memory of 1220 1328 cmd.exe 124 PID 1220 wrote to memory of 4180 1220 SDLTUR.exe 125 PID 4180 wrote to memory of 4672 4180 cmd.exe 129 PID 4672 wrote to memory of 2608 4672 YDTH.exe 130 PID 2608 wrote to memory of 5900 2608 cmd.exe 134 PID 5900 wrote to memory of 5408 5900 GJTW.exe 135 PID 5408 wrote to memory of 6040 5408 cmd.exe 139 PID 6040 wrote to memory of 5084 6040 UUBUAJF.exe 140 PID 5084 wrote to memory of 4144 5084 cmd.exe 144 PID 4144 wrote to memory of 5556 4144 FMEN.exe 145 PID 5556 wrote to memory of 5616 5556 cmd.exe 149 PID 5616 wrote to memory of 4976 5616 ZAJXL.exe 150 PID 4976 wrote to memory of 5696 4976 cmd.exe 154 PID 5696 wrote to memory of 5572 5696 DQQ.exe 155 PID 5572 wrote to memory of 5924 5572 cmd.exe 159 PID 5924 wrote to memory of 2808 5924 HYWFJ.exe 160 PID 2808 wrote to memory of 3764 2808 cmd.exe 164 PID 3764 wrote to memory of 3988 3764 SQZPSJ.exe 165 PID 3988 wrote to memory of 1200 3988 cmd.exe 169 PID 1200 wrote to memory of 4648 1200 COFKZR.exe 170 PID 4648 wrote to memory of 4504 4648 cmd.exe 174 PID 4504 wrote to memory of 2572 4504 CUFYBEM.exe 175 PID 2572 wrote to memory of 5412 2572 cmd.exe 179 PID 5412 wrote to memory of 5976 5412 XPC.exe 180 PID 5976 wrote to memory of 4800 5976 cmd.exe 184 PID 4800 wrote to memory of 3496 4800 SSSGZH.exe 185 PID 3496 wrote to memory of 3376 3496 cmd.exe 189 PID 3376 wrote to memory of 3864 3376 EKVZHWD.exe 190 PID 3864 wrote to memory of 4532 3864 cmd.exe 194 PID 4532 wrote to memory of 5196 4532 IACZM.exe 195 PID 5196 wrote to memory of 1392 5196 cmd.exe 199 PID 1392 wrote to memory of 6008 1392 RBEEXM.exe 200 PID 6008 wrote to memory of 1268 6008 cmd.exe 204 PID 1268 wrote to memory of 4024 1268 TOBOZ.exe 205 PID 4024 wrote to memory of 2944 4024 cmd.exe 209 PID 2944 wrote to memory of 1336 2944 QTTD.exe 210 PID 1336 wrote to memory of 4684 1336 cmd.exe 214 PID 4684 wrote to memory of 1536 4684 BMWWY.exe 215 PID 1536 wrote to memory of 5936 1536 cmd.exe 219 PID 5936 wrote to memory of 5576 5936 WHBFIOP.exe 220 PID 5576 wrote to memory of 4248 5576 cmd.exe 224 PID 4248 wrote to memory of 2952 4248 WNTTKBS.exe 225 PID 2952 wrote to memory of 4624 2952 cmd.exe 229 PID 4624 wrote to memory of 4688 4624 LIKGV.exe 230 PID 4688 wrote to memory of 1692 4688 cmd.exe 234 PID 1692 wrote to memory of 3080 1692 CQELYT.exe 235 PID 3080 wrote to memory of 5824 3080 cmd.exe 239 PID 5824 wrote to memory of 5004 5824 ZOK.exe 240 PID 5004 wrote to memory of 3292 5004 cmd.exe 244 PID 3292 wrote to memory of 4828 3292 KGNT.exe 245 PID 4828 wrote to memory of 5100 4828 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_fc22d5f2f0ce41e188b37fba708f4f7f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\OUSI.exeC:\windows\OUSI.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMVTV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\system\ZMVTV.exeC:\windows\system\ZMVTV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYFWN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\SysWOW64\EYFWN.exeC:\windows\system32\EYFWN.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\YDTH.exeC:\windows\YDTH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJTW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\system\GJTW.exeC:\windows\system\GJTW.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUBUAJF.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\system\UUBUAJF.exeC:\windows\system\UUBUAJF.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COFKZR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\system\COFKZR.exeC:\windows\system\COFKZR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUFYBEM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\system\CUFYBEM.exeC:\windows\system\CUFYBEM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\XPC.exeC:\windows\system\XPC.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKVZHWD.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\EKVZHWD.exeC:\windows\EKVZHWD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IACZM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\system\IACZM.exeC:\windows\system\IACZM.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\windows\QTTD.exeC:\windows\QTTD.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWWY.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\BMWWY.exeC:\windows\BMWWY.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNTTKBS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\system\WNTTKBS.exeC:\windows\system\WNTTKBS.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\LIKGV.exeC:\windows\LIKGV.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQELYT.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\CQELYT.exeC:\windows\CQELYT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\ZOK.exeC:\windows\ZOK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGNT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\SysWOW64\KGNT.exeC:\windows\system32\KGNT.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCSKYK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\FCSKYK.exeC:\windows\FCSKYK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHDCNHO.exe.bat" "66⤵PID:2576
-
C:\windows\OHDCNHO.exeC:\windows\OHDCNHO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFWWUWW.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\windows\QFWWUWW.exeC:\windows\QFWWUWW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXZP.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2028 -
C:\windows\BXZP.exeC:\windows\BXZP.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSITNYM.exe.bat" "72⤵PID:4284
-
C:\windows\system\QSITNYM.exeC:\windows\system\QSITNYM.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2444 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2044 -
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "78⤵PID:3896
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4508 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCZ.exe.bat" "84⤵PID:5944
-
C:\windows\SysWOW64\KCZ.exeC:\windows\system32\KCZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2296 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "88⤵PID:1632
-
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5080 -
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYNELF.exe.bat" "92⤵PID:5664
-
C:\windows\SysWOW64\AYNELF.exeC:\windows\system32\AYNELF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRQWT.exe.bat" "94⤵PID:5216
-
C:\windows\system\LRQWT.exeC:\windows\system\LRQWT.exe95⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXVUBWP.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\windows\system\HXVUBWP.exeC:\windows\system\HXVUBWP.exe97⤵
- Executes dropped EXE
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\windows\NXDH.exeC:\windows\NXDH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "100⤵PID:6140
-
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe101⤵
- Executes dropped EXE
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4408 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe103⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "104⤵PID:5636
-
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBM.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\windows\BBM.exeC:\windows\BBM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBTFA.exe.bat" "108⤵PID:3860
-
C:\windows\system\HBTFA.exeC:\windows\system\HBTFA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWLOFU.exe.bat" "110⤵PID:5324
-
C:\windows\system\FWLOFU.exeC:\windows\system\FWLOFU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "112⤵PID:1204
-
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "114⤵PID:1028
-
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQDIFGU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3028 -
C:\windows\SysWOW64\CQDIFGU.exeC:\windows\system32\CQDIFGU.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIGTON.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5164 -
C:\windows\system\NIGTON.exeC:\windows\system\NIGTON.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGE.exe.bat" "120⤵PID:4156
-
C:\windows\SysWOW64\KGE.exeC:\windows\system32\KGE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-