Analysis
- max time kernel
56s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe
- Size 208KB
- Sample260913-rmtywsgp5x
- SHA256 0d0dfc437b019afdef18158cb51984632a6aaa12bb1ff009696a7191ab828cef
- MD5 67d390c338fe14e08cef286c702ba4f2
- SHA1 81b1fe50253a51e37716e69ec2638679e6f9df59
- SHA512 63e36144d61501ee08415383b3193770e3ff51174cb134dc3d0aa5559c3de43985a0a6a194e2e02e5d4acaf159c59585b3e00ca434b557300f8fdae0133d207e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfM4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOUkEj1
- TLSH T186247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 61 IoCs
pid Process 3848 FKQPY.exe 6136 XRM.exe 4560 MMY.exe 460 MPOKP.exe 4688 UUTZZ.exe 476 XDCN.exe 2236 SYTPS.exe 1676 WQDZ.exe 2272 RMMBP.exe 5836 WEWDTS.exe 1972 ESAKE.exe 2680 PKQ.exe 4684 ULZFZ.exe 4156 CQEM.exe 1348 TZTJ.exe 2632 FMS.exe 6012 NSE.exe 4636 VFRCOKA.exe 2276 HNK.exe 2140 PBO.exe 4724 IOVH.exe 2468 DBNJ.exe 3288 ICO.exe 2668 YNZBXRU.exe 3340 BAI.exe 3516 ATTBZQX.exe 4628 WLVDDM.exe 4696 BRNSTQB.exe 3540 HMZLZE.exe 3892 PAESKD.exe 3420 OKOIT.exe 2704 FTVNF.exe 4224 ZYCLKJ.exe 5544 DOVLYNO.exe 5320 BZYBGT.exe 2664 THMZTK.exe 2924 OFMKV.exe 3348 FYXA.exe 296 EYLY.exe 3384 WGSD.exe 3864 NOGA.exe 4508 TKSBVX.exe 3488 BPWIGW.exe 5644 JVJOQ.exe 3416 RIWVB.exe 4944 GYJNR.exe 4804 LZLPVE.exe 1272 DZZMHV.exe 1580 ZAJXL.exe 1748 HNODW.exe 2828 XDBVLEU.exe 4960 WDPSYVP.exe 5900 TERUCRX.exe 3100 KMGAPIA.exe 980 HFQCSM.exe 3820 RCVWI.exe 3700 CDLHR.exe 6112 HWMK.exe 2132 UGDIJCW.exe 6020 IED.exe 6132 MKVJJJB.exe - Drops file in System32 directory 63 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EYLY.exe FYXA.exe File created C:\windows\SysWOW64\WGSD.exe.bat EYLY.exe File created C:\windows\SysWOW64\GYJNR.exe.bat RIWVB.exe File created C:\windows\SysWOW64\FMS.exe TZTJ.exe File created C:\windows\SysWOW64\WQDZ.exe.bat SYTPS.exe File created C:\windows\SysWOW64\ESAKE.exe.bat WEWDTS.exe File opened for modification C:\windows\SysWOW64\CQEM.exe ULZFZ.exe File created C:\windows\SysWOW64\IOVH.exe.bat PBO.exe File opened for modification C:\windows\SysWOW64\OKOIT.exe PAESKD.exe File created C:\windows\SysWOW64\WLVDDM.exe.bat ATTBZQX.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat DZZMHV.exe File created C:\windows\SysWOW64\RIWVB.exe.bat JVJOQ.exe File created C:\windows\SysWOW64\FMS.exe.bat TZTJ.exe File created C:\windows\SysWOW64\ATTBZQX.exe BAI.exe File created C:\windows\SysWOW64\OKOIT.exe.bat PAESKD.exe File opened for modification C:\windows\SysWOW64\TZTJ.exe CQEM.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe BZYBGT.exe File created C:\windows\SysWOW64\RIWVB.exe JVJOQ.exe File opened for modification C:\windows\SysWOW64\DBNJ.exe IOVH.exe File created C:\windows\SysWOW64\ATTBZQX.exe.bat BAI.exe File opened for modification C:\windows\SysWOW64\FTVNF.exe OKOIT.exe File created C:\windows\SysWOW64\THMZTK.exe.bat BZYBGT.exe File created C:\windows\SysWOW64\FYXA.exe OFMKV.exe File created C:\windows\SysWOW64\FYXA.exe.bat OFMKV.exe File opened for modification C:\windows\SysWOW64\WGSD.exe EYLY.exe File opened for modification C:\windows\SysWOW64\ESAKE.exe WEWDTS.exe File opened for modification C:\windows\SysWOW64\FMS.exe TZTJ.exe File created C:\windows\SysWOW64\EYLY.exe.bat FYXA.exe File opened for modification C:\windows\SysWOW64\ZAJXL.exe DZZMHV.exe File created C:\windows\SysWOW64\CQEM.exe ULZFZ.exe File created C:\windows\SysWOW64\FTVNF.exe.bat OKOIT.exe File created C:\windows\SysWOW64\ZAJXL.exe DZZMHV.exe File created C:\windows\SysWOW64\BAI.exe YNZBXRU.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe RIWVB.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe NOGA.exe File opened for modification C:\windows\SysWOW64\RIWVB.exe JVJOQ.exe File created C:\windows\SysWOW64\OKOIT.exe PAESKD.exe File created C:\windows\SysWOW64\TKSBVX.exe NOGA.exe File created C:\windows\SysWOW64\HNODW.exe.bat ZAJXL.exe File created C:\windows\SysWOW64\DBNJ.exe.bat IOVH.exe File opened for modification C:\windows\SysWOW64\BAI.exe YNZBXRU.exe File created C:\windows\SysWOW64\GYJNR.exe RIWVB.exe File created C:\windows\SysWOW64\WQDZ.exe SYTPS.exe File opened for modification C:\windows\SysWOW64\WQDZ.exe SYTPS.exe File created C:\windows\SysWOW64\ESAKE.exe WEWDTS.exe File created C:\windows\SysWOW64\CQEM.exe.bat ULZFZ.exe File opened for modification C:\windows\SysWOW64\ATTBZQX.exe BAI.exe File created C:\windows\SysWOW64\WLVDDM.exe ATTBZQX.exe File created C:\windows\SysWOW64\THMZTK.exe BZYBGT.exe File created C:\windows\SysWOW64\WGSD.exe EYLY.exe File created C:\windows\SysWOW64\TZTJ.exe.bat CQEM.exe File created C:\windows\SysWOW64\IOVH.exe PBO.exe File created C:\windows\SysWOW64\DBNJ.exe IOVH.exe File opened for modification C:\windows\SysWOW64\WLVDDM.exe ATTBZQX.exe File created C:\windows\SysWOW64\EYLY.exe FYXA.exe File created C:\windows\SysWOW64\HNODW.exe ZAJXL.exe File opened for modification C:\windows\SysWOW64\HNODW.exe ZAJXL.exe File created C:\windows\SysWOW64\FTVNF.exe OKOIT.exe File opened for modification C:\windows\SysWOW64\FYXA.exe OFMKV.exe File created C:\windows\SysWOW64\TZTJ.exe CQEM.exe File opened for modification C:\windows\SysWOW64\IOVH.exe PBO.exe File created C:\windows\SysWOW64\BAI.exe.bat YNZBXRU.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat NOGA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MPOKP.exe.bat MMY.exe File created C:\windows\NOGA.exe.bat WGSD.exe File created C:\windows\WDPSYVP.exe.bat XDBVLEU.exe File created C:\windows\system\MMY.exe XRM.exe File opened for modification C:\windows\MKVJJJB.exe IED.exe File created C:\windows\system\BRNSTQB.exe WLVDDM.exe File opened for modification C:\windows\system\ZYCLKJ.exe FTVNF.exe File created C:\windows\JVJOQ.exe.bat BPWIGW.exe File created C:\windows\YNZBXRU.exe.bat ICO.exe File created C:\windows\system\UXAQMI.exe MKVJJJB.exe File created C:\windows\system\VFRCOKA.exe NSE.exe File opened for modification C:\windows\HNK.exe VFRCOKA.exe File created C:\windows\system\LZLPVE.exe.bat GYJNR.exe File created C:\windows\UUTZZ.exe.bat MPOKP.exe File created C:\windows\system\DOVLYNO.exe ZYCLKJ.exe File created C:\windows\system\MPOKP.exe MMY.exe File created C:\windows\system\PBO.exe.bat HNK.exe File opened for modification C:\windows\system\UGDIJCW.exe HWMK.exe File created C:\windows\MKVJJJB.exe.bat IED.exe File opened for modification C:\windows\system\FKQPY.exe 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe File created C:\windows\system\ZYCLKJ.exe FTVNF.exe File created C:\windows\HFQCSM.exe KMGAPIA.exe File opened for modification C:\windows\IED.exe UGDIJCW.exe File created C:\windows\system\UXAQMI.exe.bat MKVJJJB.exe File created C:\windows\XRM.exe FKQPY.exe File opened for modification C:\windows\ICO.exe DBNJ.exe File opened for modification C:\windows\PAESKD.exe HMZLZE.exe File created C:\windows\system\ZYCLKJ.exe.bat FTVNF.exe File opened for modification C:\windows\XDCN.exe UUTZZ.exe File opened for modification C:\windows\system\SYTPS.exe XDCN.exe File opened for modification C:\windows\system\VFRCOKA.exe NSE.exe File opened for modification C:\windows\OFMKV.exe THMZTK.exe File opened for modification C:\windows\JVJOQ.exe BPWIGW.exe File opened for modification C:\windows\system\RCVWI.exe HFQCSM.exe File created C:\windows\system\FKQPY.exe 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe File created C:\windows\ICO.exe.bat DBNJ.exe File created C:\windows\system\HMZLZE.exe.bat BRNSTQB.exe File opened for modification C:\windows\NOGA.exe WGSD.exe File created C:\windows\TERUCRX.exe.bat WDPSYVP.exe File created C:\windows\system\UGDIJCW.exe HWMK.exe File created C:\windows\system\SYTPS.exe XDCN.exe File created C:\windows\PKQ.exe ESAKE.exe File created C:\windows\system\VFRCOKA.exe.bat NSE.exe File created C:\windows\KMGAPIA.exe TERUCRX.exe File created C:\windows\KMGAPIA.exe.bat TERUCRX.exe File opened for modification C:\windows\system\CDLHR.exe RCVWI.exe File opened for modification C:\windows\XRM.exe FKQPY.exe File created C:\windows\system\CDLHR.exe RCVWI.exe File created C:\windows\IED.exe UGDIJCW.exe File created C:\windows\PAESKD.exe HMZLZE.exe File created C:\windows\system\DOVLYNO.exe.bat ZYCLKJ.exe File opened for modification C:\windows\WDPSYVP.exe XDBVLEU.exe File created C:\windows\system\RCVWI.exe.bat HFQCSM.exe File created C:\windows\XRM.exe.bat FKQPY.exe File opened for modification C:\windows\system\WEWDTS.exe RMMBP.exe File created C:\windows\JVJOQ.exe BPWIGW.exe File opened for modification C:\windows\HWMK.exe CDLHR.exe File created C:\windows\UUTZZ.exe MPOKP.exe File created C:\windows\HNK.exe.bat VFRCOKA.exe File created C:\windows\system\NSE.exe.bat FMS.exe File opened for modification C:\windows\HFQCSM.exe KMGAPIA.exe File created C:\windows\HWMK.exe CDLHR.exe File created C:\windows\RMMBP.exe WQDZ.exe File created C:\windows\RMMBP.exe.bat WQDZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5704 cmd.exe 5984 cmd.exe 5596 cmd.exe 4424 cmd.exe 2544 cmd.exe 3768 cmd.exe 3016 cmd.exe 5912 cmd.exe 5112 cmd.exe 2212 cmd.exe 2012 cmd.exe 5708 cmd.exe 1700 cmd.exe 2244 cmd.exe 1220 cmd.exe 3816 cmd.exe 4128 cmd.exe 4624 cmd.exe 4788 cmd.exe 1652 cmd.exe 5028 cmd.exe 4832 cmd.exe 4300 cmd.exe 5464 cmd.exe 4440 cmd.exe 2872 cmd.exe 4052 cmd.exe 6024 cmd.exe 3408 cmd.exe 2744 cmd.exe 4520 cmd.exe 3396 cmd.exe 3004 cmd.exe 2280 cmd.exe 1880 cmd.exe 1596 cmd.exe 1804 cmd.exe 5232 cmd.exe 5968 cmd.exe 4312 cmd.exe 6096 cmd.exe 3088 cmd.exe 6008 cmd.exe 1072 cmd.exe 1900 cmd.exe 4816 cmd.exe 5072 cmd.exe 5792 cmd.exe 1948 cmd.exe 2256 cmd.exe 2944 cmd.exe 2324 cmd.exe 4044 cmd.exe 4728 cmd.exe 3256 cmd.exe 1188 cmd.exe 1540 cmd.exe 5948 cmd.exe 2464 cmd.exe 3400 cmd.exe 4544 cmd.exe 1204 cmd.exe 5588 cmd.exe 5832 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3004 5796 WerFault.exe 86 5972 3848 WerFault.exe 91 2836 6136 WerFault.exe 96 4500 4560 WerFault.exe 102 6068 460 WerFault.exe 107 4524 4688 WerFault.exe 112 1508 476 WerFault.exe 117 3696 2236 WerFault.exe 122 5724 1676 WerFault.exe 127 4260 2272 WerFault.exe 132 5128 5836 WerFault.exe 137 1532 1972 WerFault.exe 142 4764 2680 WerFault.exe 147 2636 4684 WerFault.exe 152 5708 4156 WerFault.exe 157 2836 1348 WerFault.exe 162 4536 2632 WerFault.exe 167 3512 6012 WerFault.exe 172 2012 4636 WerFault.exe 177 2428 2276 WerFault.exe 182 2712 2140 WerFault.exe 187 3856 4724 WerFault.exe 192 3832 2468 WerFault.exe 197 4732 3288 WerFault.exe 202 1604 2668 WerFault.exe 207 6020 3340 WerFault.exe 212 256 3516 WerFault.exe 217 1268 4628 WerFault.exe 222 888 4696 WerFault.exe 227 3768 3540 WerFault.exe 232 1228 3892 WerFault.exe 237 5116 3420 WerFault.exe 242 1364 2704 WerFault.exe 247 1484 4224 WerFault.exe 253 1860 5544 WerFault.exe 258 3052 5320 WerFault.exe 263 2212 2664 WerFault.exe 268 2416 2924 WerFault.exe 273 1220 3348 WerFault.exe 278 2248 296 WerFault.exe 283 1132 3384 WerFault.exe 288 1284 3864 WerFault.exe 293 3092 4508 WerFault.exe 298 4984 3488 WerFault.exe 303 1108 5644 WerFault.exe 308 6064 3416 WerFault.exe 313 1860 4944 WerFault.exe 318 3168 4804 WerFault.exe 323 4252 1272 WerFault.exe 328 4540 1580 WerFault.exe 333 5228 1748 WerFault.exe 338 4264 2828 WerFault.exe 343 4756 4960 WerFault.exe 348 5312 5900 WerFault.exe 353 700 3100 WerFault.exe 358 4484 980 WerFault.exe 363 4448 3820 WerFault.exe 368 2636 3700 WerFault.exe 373 2416 6112 WerFault.exe 378 4424 2132 WerFault.exe 383 5024 6020 WerFault.exe 388 5640 6132 WerFault.exe 393 2440 3044 WerFault.exe 398 1192 2904 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFMKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFRCOKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIWVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDLHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZZMHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKOIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNZBXRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKQPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZYBGT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFQCSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLVDDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMMBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PAESKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTVNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPOKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYTPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPWIGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYJNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNODW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMZLZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOVLYNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5796 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe 5796 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe 3848 FKQPY.exe 3848 FKQPY.exe 6136 XRM.exe 6136 XRM.exe 4560 MMY.exe 4560 MMY.exe 460 MPOKP.exe 460 MPOKP.exe 4688 UUTZZ.exe 4688 UUTZZ.exe 476 XDCN.exe 476 XDCN.exe 2236 SYTPS.exe 2236 SYTPS.exe 1676 WQDZ.exe 1676 WQDZ.exe 2272 RMMBP.exe 2272 RMMBP.exe 5836 WEWDTS.exe 5836 WEWDTS.exe 1972 ESAKE.exe 1972 ESAKE.exe 2680 PKQ.exe 2680 PKQ.exe 4684 ULZFZ.exe 4684 ULZFZ.exe 4156 CQEM.exe 4156 CQEM.exe 1348 TZTJ.exe 1348 TZTJ.exe 2632 FMS.exe 2632 FMS.exe 6012 NSE.exe 6012 NSE.exe 4636 VFRCOKA.exe 4636 VFRCOKA.exe 2276 HNK.exe 2276 HNK.exe 2140 PBO.exe 2140 PBO.exe 4724 IOVH.exe 4724 IOVH.exe 2468 DBNJ.exe 2468 DBNJ.exe 3288 ICO.exe 3288 ICO.exe 2668 YNZBXRU.exe 2668 YNZBXRU.exe 3340 BAI.exe 3340 BAI.exe 3516 ATTBZQX.exe 3516 ATTBZQX.exe 4628 WLVDDM.exe 4628 WLVDDM.exe 4696 BRNSTQB.exe 4696 BRNSTQB.exe 3540 HMZLZE.exe 3540 HMZLZE.exe 3892 PAESKD.exe 3892 PAESKD.exe 3420 OKOIT.exe 3420 OKOIT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5796 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe 5796 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe 3848 FKQPY.exe 3848 FKQPY.exe 6136 XRM.exe 6136 XRM.exe 4560 MMY.exe 4560 MMY.exe 460 MPOKP.exe 460 MPOKP.exe 4688 UUTZZ.exe 4688 UUTZZ.exe 476 XDCN.exe 476 XDCN.exe 2236 SYTPS.exe 2236 SYTPS.exe 1676 WQDZ.exe 1676 WQDZ.exe 2272 RMMBP.exe 2272 RMMBP.exe 5836 WEWDTS.exe 5836 WEWDTS.exe 1972 ESAKE.exe 1972 ESAKE.exe 2680 PKQ.exe 2680 PKQ.exe 4684 ULZFZ.exe 4684 ULZFZ.exe 4156 CQEM.exe 4156 CQEM.exe 1348 TZTJ.exe 1348 TZTJ.exe 2632 FMS.exe 2632 FMS.exe 6012 NSE.exe 6012 NSE.exe 4636 VFRCOKA.exe 4636 VFRCOKA.exe 2276 HNK.exe 2276 HNK.exe 2140 PBO.exe 2140 PBO.exe 4724 IOVH.exe 4724 IOVH.exe 2468 DBNJ.exe 2468 DBNJ.exe 3288 ICO.exe 3288 ICO.exe 2668 YNZBXRU.exe 2668 YNZBXRU.exe 3340 BAI.exe 3340 BAI.exe 3516 ATTBZQX.exe 3516 ATTBZQX.exe 4628 WLVDDM.exe 4628 WLVDDM.exe 4696 BRNSTQB.exe 4696 BRNSTQB.exe 3540 HMZLZE.exe 3540 HMZLZE.exe 3892 PAESKD.exe 3892 PAESKD.exe 3420 OKOIT.exe 3420 OKOIT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5796 wrote to memory of 1740 5796 2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe 87 PID 1740 wrote to memory of 3848 1740 cmd.exe 91 PID 3848 wrote to memory of 2852 3848 FKQPY.exe 93 PID 2852 wrote to memory of 6136 2852 cmd.exe 96 PID 6136 wrote to memory of 5860 6136 XRM.exe 98 PID 5860 wrote to memory of 4560 5860 cmd.exe 102 PID 4560 wrote to memory of 4044 4560 MMY.exe 103 PID 4044 wrote to memory of 460 4044 cmd.exe 107 PID 460 wrote to memory of 940 460 MPOKP.exe 108 PID 940 wrote to memory of 4688 940 cmd.exe 112 PID 4688 wrote to memory of 4660 4688 UUTZZ.exe 113 PID 4660 wrote to memory of 476 4660 cmd.exe 117 PID 476 wrote to memory of 4728 476 XDCN.exe 118 PID 4728 wrote to memory of 2236 4728 cmd.exe 122 PID 2236 wrote to memory of 5704 2236 SYTPS.exe 123 PID 5704 wrote to memory of 1676 5704 cmd.exe 127 PID 1676 wrote to memory of 4204 1676 WQDZ.exe 128 PID 4204 wrote to memory of 2272 4204 cmd.exe 132 PID 2272 wrote to memory of 2052 2272 RMMBP.exe 133 PID 2052 wrote to memory of 5836 2052 cmd.exe 137 PID 5836 wrote to memory of 4788 5836 WEWDTS.exe 138 PID 4788 wrote to memory of 1972 4788 cmd.exe 142 PID 1972 wrote to memory of 3816 1972 ESAKE.exe 143 PID 3816 wrote to memory of 2680 3816 cmd.exe 147 PID 2680 wrote to memory of 2312 2680 PKQ.exe 148 PID 2312 wrote to memory of 4684 2312 cmd.exe 152 PID 4684 wrote to memory of 2564 4684 ULZFZ.exe 153 PID 2564 wrote to memory of 4156 2564 cmd.exe 157 PID 4156 wrote to memory of 4544 4156 CQEM.exe 158 PID 4544 wrote to memory of 1348 4544 cmd.exe 162 PID 1348 wrote to memory of 2872 1348 TZTJ.exe 163 PID 2872 wrote to memory of 2632 2872 cmd.exe 167 PID 2632 wrote to memory of 4784 2632 FMS.exe 168 PID 4784 wrote to memory of 6012 4784 cmd.exe 172 PID 6012 wrote to memory of 3876 6012 NSE.exe 173 PID 3876 wrote to memory of 4636 3876 cmd.exe 177 PID 4636 wrote to memory of 2912 4636 VFRCOKA.exe 178 PID 2912 wrote to memory of 2276 2912 cmd.exe 182 PID 2276 wrote to memory of 3088 2276 HNK.exe 183 PID 3088 wrote to memory of 2140 3088 cmd.exe 187 PID 2140 wrote to memory of 3256 2140 PBO.exe 188 PID 3256 wrote to memory of 4724 3256 cmd.exe 192 PID 4724 wrote to memory of 1652 4724 IOVH.exe 193 PID 1652 wrote to memory of 2468 1652 cmd.exe 197 PID 2468 wrote to memory of 1204 2468 DBNJ.exe 198 PID 1204 wrote to memory of 3288 1204 cmd.exe 202 PID 3288 wrote to memory of 5028 3288 ICO.exe 203 PID 5028 wrote to memory of 2668 5028 cmd.exe 207 PID 2668 wrote to memory of 5588 2668 YNZBXRU.exe 208 PID 5588 wrote to memory of 3340 5588 cmd.exe 212 PID 3340 wrote to memory of 3004 3340 BAI.exe 213 PID 3004 wrote to memory of 3516 3004 cmd.exe 217 PID 3516 wrote to memory of 5912 3516 ATTBZQX.exe 218 PID 5912 wrote to memory of 4628 5912 cmd.exe 222 PID 4628 wrote to memory of 4748 4628 WLVDDM.exe 223 PID 4748 wrote to memory of 4696 4748 cmd.exe 227 PID 4696 wrote to memory of 5816 4696 BRNSTQB.exe 228 PID 5816 wrote to memory of 3540 5816 cmd.exe 232 PID 3540 wrote to memory of 240 3540 HMZLZE.exe 233 PID 240 wrote to memory of 3892 240 cmd.exe 237 PID 3892 wrote to memory of 2280 3892 PAESKD.exe 238 PID 2280 wrote to memory of 3420 2280 cmd.exe 242 PID 3420 wrote to memory of 5112 3420 OKOIT.exe 243 PID 5112 wrote to memory of 2704 5112 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_67d390c338fe14e08cef286c702ba4f2_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKQPY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\windows\system\FKQPY.exeC:\windows\system\FKQPY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\XRM.exeC:\windows\XRM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMY.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\MMY.exeC:\windows\system\MMY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPOKP.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\windows\system\MPOKP.exeC:\windows\system\MPOKP.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUTZZ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\UUTZZ.exeC:\windows\UUTZZ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDCN.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\XDCN.exeC:\windows\XDCN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYTPS.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\system\SYTPS.exeC:\windows\system\SYTPS.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQDZ.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\SysWOW64\WQDZ.exeC:\windows\system32\WQDZ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RMMBP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\RMMBP.exeC:\windows\RMMBP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEWDTS.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\system\WEWDTS.exeC:\windows\system\WEWDTS.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ESAKE.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\SysWOW64\ESAKE.exeC:\windows\system32\ESAKE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKQ.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\PKQ.exeC:\windows\PKQ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ULZFZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\system\ULZFZ.exeC:\windows\system\ULZFZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQEM.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\SysWOW64\CQEM.exeC:\windows\system32\CQEM.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZTJ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\SysWOW64\TZTJ.exeC:\windows\system32\TZTJ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMS.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\SysWOW64\FMS.exeC:\windows\system32\FMS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\system\NSE.exeC:\windows\system\NSE.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFRCOKA.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\system\VFRCOKA.exeC:\windows\system\VFRCOKA.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\HNK.exeC:\windows\HNK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBO.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\system\PBO.exeC:\windows\system\PBO.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IOVH.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\IOVH.exeC:\windows\system32\IOVH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBNJ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\SysWOW64\DBNJ.exeC:\windows\system32\DBNJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICO.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\ICO.exeC:\windows\ICO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNZBXRU.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\YNZBXRU.exeC:\windows\YNZBXRU.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAI.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\SysWOW64\BAI.exeC:\windows\system32\BAI.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATTBZQX.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\SysWOW64\ATTBZQX.exeC:\windows\system32\ATTBZQX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLVDDM.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\SysWOW64\WLVDDM.exeC:\windows\system32\WLVDDM.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BRNSTQB.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\system\BRNSTQB.exeC:\windows\system\BRNSTQB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMZLZE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\HMZLZE.exeC:\windows\system\HMZLZE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\PAESKD.exeC:\windows\PAESKD.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKOIT.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\SysWOW64\OKOIT.exeC:\windows\system32\OKOIT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTVNF.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\windows\SysWOW64\FTVNF.exeC:\windows\system32\FTVNF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYCLKJ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5832 -
C:\windows\system\ZYCLKJ.exeC:\windows\system\ZYCLKJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZYBGT.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\windows\BZYBGT.exeC:\windows\BZYBGT.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFMKV.exe.bat" "74⤵PID:752
-
C:\windows\OFMKV.exeC:\windows\OFMKV.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2256 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLY.exe.bat" "78⤵PID:4136
-
C:\windows\SysWOW64\EYLY.exeC:\windows\system32\EYLY.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "80⤵PID:368
-
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\windows\NOGA.exeC:\windows\NOGA.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe85⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPWIGW.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4312 -
C:\windows\system\BPWIGW.exeC:\windows\system\BPWIGW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "88⤵PID:2088
-
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1188 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe95⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4128 -
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4832 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNODW.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5944 -
C:\windows\SysWOW64\HNODW.exeC:\windows\system32\HNODW.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3920 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDPSYVP.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\WDPSYVP.exeC:\windows\WDPSYVP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1648 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "108⤵PID:3308
-
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RCVWI.exe.bat" "112⤵
- Executes a command shell one-liner
PID:6008 -
C:\windows\system\RCVWI.exeC:\windows\system\RCVWI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "114⤵PID:3320
-
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWMK.exe.bat" "116⤵PID:2100
-
C:\windows\HWMK.exeC:\windows\HWMK.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGDIJCW.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\windows\system\UGDIJCW.exeC:\windows\system\UGDIJCW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "120⤵PID:4244
-
C:\windows\IED.exeC:\windows\IED.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-