Analysis
- max time kernel
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe
- Size 208KB
- Sample260916-rd99hs1erb
- SHA256 12c693d41f62be11821823a0f61629fc550cec32fe165c50ddd1bd70db11c79c
- MD5 1920c7219b966b06604293473bb14de1
- SHA1 196ffa5bf1684a0f7e66e5f42b21d8839e69cf47
- SHA512 714cd37ad2024a76a4545b8e729a55d779c0e6a9192c6a17503f8c73efb95505ddcff44b3a1fc0e000d6e0e8a491b4a229e8ad8ababea44d7d249e289b634151
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfw4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LO4kEj1
- TLSH T110247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3676 WZGNU.exe 5684 TXGXTG.exe 5172 INHO.exe 5676 WQPNGNR.exe 6140 PDWLLO.exe 4728 KZT.exe 5608 XBK.exe 4944 SXPD.exe 6076 ACHRV.exe 4876 CAU.exe 1964 MYAGKUH.exe 4676 GLFP.exe 5052 BYKYFU.exe 2032 AJMON.exe 5252 NUD.exe 2304 CKEFAY.exe 3628 BAPHV.exe 3116 BDTDBB.exe 2540 ZYSM.exe 828 VJIDTHL.exe 5196 NEMGZX.exe 1968 OHQ.exe 240 DCAOXI.exe 4576 YXE.exe 5692 HYGD.exe 2904 GIJ.exe 2352 ZBZ.exe 4568 SECAJ.exe 4260 YEKNSEC.exe 4740 EAJWW.exe 1284 RKS.exe 5144 VSYVX.exe 2404 PGDEHCQ.exe 2140 LWM.exe 1460 WPPC.exe 5312 FXRPI.exe 4500 GSULOVZ.exe 1672 VVEPZ.exe 4384 OQIT.exe 5980 ILNCPF.exe 4544 JGQ.exe 5324 CJUCI.exe 5032 HKCPRNK.exe 2456 LSIP.exe 708 ONNHNF.exe 1124 JAS.exe 5028 UTVJ.exe 5328 YBCJKF.exe 1540 SWG.exe 824 CXIYYC.exe 2568 TFK.exe 1492 CKVV.exe 120 IFUDVZ.exe 2408 MVBE.exe 2672 YEHMMK.exe 1180 YJIAVXW.exe 3552 XHTVICE.exe 4408 IZWORJT.exe 912 TSR.exe 3680 XAFHD.exe 4800 XGY.exe 5088 JWEDR.exe 1040 YBKSY.exe 4804 APPCIQE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CJUCI.exe JGQ.exe File created C:\windows\SysWOW64\SWG.exe YBCJKF.exe File created C:\windows\SysWOW64\XAFHD.exe TSR.exe File created C:\windows\SysWOW64\EIVUBU.exe.bat JUQK.exe File created C:\windows\SysWOW64\IZWORJT.exe XHTVICE.exe File created C:\windows\SysWOW64\VJIDTHL.exe.bat ZYSM.exe File created C:\windows\SysWOW64\NEMGZX.exe VJIDTHL.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe YEKNSEC.exe File created C:\windows\SysWOW64\VVEPZ.exe GSULOVZ.exe File opened for modification C:\windows\SysWOW64\EIVUBU.exe JUQK.exe File opened for modification C:\windows\SysWOW64\CKEFAY.exe NUD.exe File created C:\windows\SysWOW64\YBCJKF.exe UTVJ.exe File created C:\windows\SysWOW64\XAFHD.exe.bat TSR.exe File opened for modification C:\windows\SysWOW64\IWN.exe HTKG.exe File created C:\windows\SysWOW64\VNRE.exe LQLKN.exe File opened for modification C:\windows\SysWOW64\VBFA.exe YVZDMUO.exe File opened for modification C:\windows\SysWOW64\SQISQOS.exe XDDJN.exe File created C:\windows\SysWOW64\VNRE.exe.bat LQLKN.exe File opened for modification C:\windows\SysWOW64\LRETD.exe QEA.exe File created C:\windows\SysWOW64\CMB.exe WMTFL.exe File created C:\windows\SysWOW64\INHO.exe TXGXTG.exe File opened for modification C:\windows\SysWOW64\PDWLLO.exe WQPNGNR.exe File created C:\windows\SysWOW64\VJIDTHL.exe ZYSM.exe File opened for modification C:\windows\SysWOW64\NEMGZX.exe VJIDTHL.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat OHQ.exe File created C:\windows\SysWOW64\SWG.exe.bat YBCJKF.exe File created C:\windows\SysWOW64\MVBE.exe.bat IFUDVZ.exe File opened for modification C:\windows\SysWOW64\LHYTW.exe WMPHDTJ.exe File created C:\windows\SysWOW64\XBK.exe.bat KZT.exe File opened for modification C:\windows\SysWOW64\AJMON.exe BYKYFU.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat FXRPI.exe File created C:\windows\SysWOW64\LHYTW.exe.bat WMPHDTJ.exe File created C:\windows\SysWOW64\YVZDMUO.exe EIVUBU.exe File created C:\windows\SysWOW64\YVZDMUO.exe.bat EIVUBU.exe File opened for modification C:\windows\SysWOW64\WMTFL.exe SWN.exe File created C:\windows\SysWOW64\WMTFL.exe.bat SWN.exe File created C:\windows\SysWOW64\CKEFAY.exe.bat NUD.exe File created C:\windows\SysWOW64\GSULOVZ.exe FXRPI.exe File opened for modification C:\windows\SysWOW64\GSULOVZ.exe FXRPI.exe File created C:\windows\SysWOW64\IWN.exe HTKG.exe File created C:\windows\SysWOW64\IWN.exe.bat HTKG.exe File opened for modification C:\windows\SysWOW64\VNRE.exe LQLKN.exe File created C:\windows\SysWOW64\VBFA.exe YVZDMUO.exe File created C:\windows\SysWOW64\WMTFL.exe SWN.exe File created C:\windows\SysWOW64\CAU.exe ACHRV.exe File opened for modification C:\windows\SysWOW64\CAU.exe ACHRV.exe File created C:\windows\SysWOW64\BDTDBB.exe BAPHV.exe File opened for modification C:\windows\SysWOW64\VJIDTHL.exe ZYSM.exe File created C:\windows\SysWOW64\SQISQOS.exe XDDJN.exe File created C:\windows\SysWOW64\LHYTW.exe WMPHDTJ.exe File opened for modification C:\windows\SysWOW64\MVBE.exe IFUDVZ.exe File opened for modification C:\windows\SysWOW64\IZWORJT.exe XHTVICE.exe File created C:\windows\SysWOW64\XBK.exe KZT.exe File created C:\windows\SysWOW64\AJMON.exe.bat BYKYFU.exe File created C:\windows\SysWOW64\BDTDBB.exe.bat BAPHV.exe File opened for modification C:\windows\SysWOW64\YBCJKF.exe UTVJ.exe File opened for modification C:\windows\SysWOW64\SWG.exe YBCJKF.exe File created C:\windows\SysWOW64\CJUCI.exe.bat JGQ.exe File created C:\windows\SysWOW64\YBCJKF.exe.bat UTVJ.exe File created C:\windows\SysWOW64\MVBE.exe IFUDVZ.exe File opened for modification C:\windows\SysWOW64\XBK.exe KZT.exe File created C:\windows\SysWOW64\CKEFAY.exe NUD.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe OHQ.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe JGQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BVLAVHD.exe TFK.exe File created C:\windows\system\TXGXTG.exe.bat WZGNU.exe File created C:\windows\system\ZYSM.exe.bat BDTDBB.exe File created C:\windows\LWM.exe.bat VBCFE.exe File opened for modification C:\windows\WPPC.exe LWM.exe File created C:\windows\WMPHDTJ.exe PVO.exe File opened for modification C:\windows\JAS.exe ONNHNF.exe File created C:\windows\system\YBKSY.exe.bat JWEDR.exe File opened for modification C:\windows\QEA.exe OQVAID.exe File created C:\windows\SWN.exe BVLAVHD.exe File opened for modification C:\windows\system\OHQ.exe NEMGZX.exe File created C:\windows\system\EXVK.exe APPCIQE.exe File created C:\windows\TFK.exe.bat ANC.exe File opened for modification C:\windows\system\TSR.exe IZWORJT.exe File created C:\windows\YZDXYP.exe.bat DMYN.exe File opened for modification C:\windows\JUQK.exe PHLBHVW.exe File opened for modification C:\windows\system\KZT.exe PDWLLO.exe File created C:\windows\PVO.exe SQISQOS.exe File created C:\windows\PVO.exe.bat SQISQOS.exe File created C:\windows\system\DMYN.exe RWRNJ.exe File created C:\windows\system\OQVAID.exe.bat VNRE.exe File created C:\windows\IFUDVZ.exe CKVV.exe File opened for modification C:\windows\system\TXGXTG.exe WZGNU.exe File created C:\windows\HKCPRNK.exe.bat CJUCI.exe File created C:\windows\APPCIQE.exe YBKSY.exe File created C:\windows\system\RKS.exe EAJWW.exe File created C:\windows\VSYVX.exe.bat RKS.exe File created C:\windows\YJIAVXW.exe YEHMMK.exe File created C:\windows\HIFKJMY.exe YZDXYP.exe File created C:\windows\system\TER.exe GTATB.exe File created C:\windows\ANC.exe.bat RFAKCWE.exe File created C:\windows\system\SXPD.exe.bat XBK.exe File created C:\windows\system\ILNCPF.exe.bat OQIT.exe File opened for modification C:\windows\YZDXYP.exe DMYN.exe File created C:\windows\system\KZT.exe.bat PDWLLO.exe File opened for modification C:\windows\MYAGKUH.exe CAU.exe File created C:\windows\system\BAPHV.exe.bat CKEFAY.exe File created C:\windows\DJSTL.exe.bat IWN.exe File opened for modification C:\windows\system\DMYN.exe RWRNJ.exe File created C:\windows\JUQK.exe.bat PHLBHVW.exe File opened for modification C:\windows\SWN.exe BVLAVHD.exe File created C:\windows\PGDEHCQ.exe.bat VSYVX.exe File created C:\windows\system\FXRPI.exe.bat WPPC.exe File created C:\windows\system\IHI.exe GUDDHG.exe File created C:\windows\RASTA.exe IVIB.exe File created C:\windows\OQIT.exe.bat VVEPZ.exe File created C:\windows\system\TFK.exe.bat CXIYYC.exe File created C:\windows\YEHMMK.exe.bat MVBE.exe File opened for modification C:\windows\ORWBR.exe TER.exe File created C:\windows\system\TXGXTG.exe WZGNU.exe File opened for modification C:\windows\PGDEHCQ.exe VSYVX.exe File opened for modification C:\windows\system\ILNCPF.exe OQIT.exe File created C:\windows\system\TER.exe.bat GTATB.exe File created C:\windows\system\NUD.exe AJMON.exe File created C:\windows\system\NUD.exe.bat AJMON.exe File created C:\windows\ZBZ.exe GIJ.exe File created C:\windows\system\FXRPI.exe WPPC.exe File created C:\windows\XHTVICE.exe YJIAVXW.exe File opened for modification C:\windows\system\XGY.exe XAFHD.exe File opened for modification C:\windows\GUDDHG.exe LHYTW.exe File opened for modification C:\windows\ANC.exe RFAKCWE.exe File created C:\windows\system\BAPHV.exe CKEFAY.exe File created C:\windows\system\RKS.exe.bat EAJWW.exe File opened for modification C:\windows\IVIB.exe IHI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2988 cmd.exe 2496 cmd.exe 1980 cmd.exe 1960 cmd.exe 2468 cmd.exe 5636 cmd.exe 1956 cmd.exe 2520 cmd.exe 472 cmd.exe 5652 cmd.exe 5216 cmd.exe 5592 cmd.exe 932 cmd.exe 4200 cmd.exe 1852 cmd.exe 2348 cmd.exe 612 cmd.exe 1484 cmd.exe 1828 cmd.exe 5928 cmd.exe 5776 cmd.exe 548 cmd.exe 4192 cmd.exe 4640 cmd.exe 2384 cmd.exe 4616 cmd.exe 4312 cmd.exe 2108 cmd.exe 5168 cmd.exe 5956 cmd.exe 5180 cmd.exe 2940 cmd.exe 2944 cmd.exe 5696 cmd.exe 2844 cmd.exe 1372 cmd.exe 416 cmd.exe 4692 cmd.exe 4432 cmd.exe 4928 cmd.exe 3800 cmd.exe 5772 cmd.exe 3212 cmd.exe 260 cmd.exe 3624 cmd.exe 3520 cmd.exe 6096 cmd.exe 4532 cmd.exe 5404 cmd.exe 3496 cmd.exe 5812 cmd.exe 1836 cmd.exe 904 cmd.exe 480 cmd.exe 2564 cmd.exe 3580 cmd.exe 616 cmd.exe 4324 cmd.exe 2516 cmd.exe 2764 cmd.exe 3612 cmd.exe 4076 cmd.exe 3128 cmd.exe 3884 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5464 3368 WerFault.exe 86 6112 3676 WerFault.exe 91 2320 5684 WerFault.exe 97 1324 5172 WerFault.exe 102 1620 5676 WerFault.exe 107 6024 6140 WerFault.exe 112 2180 4728 WerFault.exe 117 2624 5608 WerFault.exe 122 5912 4944 WerFault.exe 127 3324 6076 WerFault.exe 132 3596 4876 WerFault.exe 137 2516 1964 WerFault.exe 142 1276 4676 WerFault.exe 147 5248 5052 WerFault.exe 152 3624 2032 WerFault.exe 157 5420 5252 WerFault.exe 162 1540 2304 WerFault.exe 167 3168 3628 WerFault.exe 172 2624 3116 WerFault.exe 177 4160 2540 WerFault.exe 182 4844 828 WerFault.exe 187 4116 5196 WerFault.exe 192 4144 1968 WerFault.exe 197 344 240 WerFault.exe 202 1800 4576 WerFault.exe 207 4244 5692 WerFault.exe 212 3672 2904 WerFault.exe 217 6084 2352 WerFault.exe 222 1388 4568 WerFault.exe 227 5844 4260 WerFault.exe 232 3620 4740 WerFault.exe 237 3324 1284 WerFault.exe 242 5040 5144 WerFault.exe 247 3272 2404 WerFault.exe 252 5440 948 WerFault.exe 257 4720 2140 WerFault.exe 262 1124 1460 WerFault.exe 267 808 5312 WerFault.exe 272 4408 4500 WerFault.exe 277 4412 1672 WerFault.exe 282 5612 4384 WerFault.exe 287 3620 5980 WerFault.exe 292 4892 4544 WerFault.exe 297 1556 5324 WerFault.exe 302 2408 5032 WerFault.exe 307 3184 2456 WerFault.exe 312 2156 708 WerFault.exe 317 4696 1124 WerFault.exe 322 4408 5028 WerFault.exe 327 912 5328 WerFault.exe 332 4592 1540 WerFault.exe 337 412 824 WerFault.exe 342 5404 2568 WerFault.exe 347 5804 1492 WerFault.exe 352 5408 120 WerFault.exe 357 548 2408 WerFault.exe 362 5744 2672 WerFault.exe 367 6088 1180 WerFault.exe 372 3240 3552 WerFault.exe 377 4960 4408 WerFault.exe 382 1256 912 WerFault.exe 387 2760 3680 WerFault.exe 392 796 4800 WerFault.exe 397 4344 5088 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVAID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWRNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APPCIQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORWBR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZGNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXIYYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEHMMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RASTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNGHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIFKJMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVEPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBKSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVLAVHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMWPRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDMQXKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJMON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXVK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3368 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe 3368 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe 3676 WZGNU.exe 3676 WZGNU.exe 5684 TXGXTG.exe 5684 TXGXTG.exe 5172 INHO.exe 5172 INHO.exe 5676 WQPNGNR.exe 5676 WQPNGNR.exe 6140 PDWLLO.exe 6140 PDWLLO.exe 4728 KZT.exe 4728 KZT.exe 5608 XBK.exe 5608 XBK.exe 4944 SXPD.exe 4944 SXPD.exe 6076 ACHRV.exe 6076 ACHRV.exe 4876 CAU.exe 4876 CAU.exe 1964 MYAGKUH.exe 1964 MYAGKUH.exe 4676 GLFP.exe 4676 GLFP.exe 5052 BYKYFU.exe 5052 BYKYFU.exe 2032 AJMON.exe 2032 AJMON.exe 5252 NUD.exe 5252 NUD.exe 2304 CKEFAY.exe 2304 CKEFAY.exe 3628 BAPHV.exe 3628 BAPHV.exe 3116 BDTDBB.exe 3116 BDTDBB.exe 2540 ZYSM.exe 2540 ZYSM.exe 828 VJIDTHL.exe 828 VJIDTHL.exe 5196 NEMGZX.exe 5196 NEMGZX.exe 1968 OHQ.exe 1968 OHQ.exe 240 DCAOXI.exe 240 DCAOXI.exe 4576 YXE.exe 4576 YXE.exe 5692 HYGD.exe 5692 HYGD.exe 2904 GIJ.exe 2904 GIJ.exe 2352 ZBZ.exe 2352 ZBZ.exe 4568 SECAJ.exe 4568 SECAJ.exe 4260 YEKNSEC.exe 4260 YEKNSEC.exe 4740 EAJWW.exe 4740 EAJWW.exe 1284 RKS.exe 1284 RKS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3368 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe 3368 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe 3676 WZGNU.exe 3676 WZGNU.exe 5684 TXGXTG.exe 5684 TXGXTG.exe 5172 INHO.exe 5172 INHO.exe 5676 WQPNGNR.exe 5676 WQPNGNR.exe 6140 PDWLLO.exe 6140 PDWLLO.exe 4728 KZT.exe 4728 KZT.exe 5608 XBK.exe 5608 XBK.exe 4944 SXPD.exe 4944 SXPD.exe 6076 ACHRV.exe 6076 ACHRV.exe 4876 CAU.exe 4876 CAU.exe 1964 MYAGKUH.exe 1964 MYAGKUH.exe 4676 GLFP.exe 4676 GLFP.exe 5052 BYKYFU.exe 5052 BYKYFU.exe 2032 AJMON.exe 2032 AJMON.exe 5252 NUD.exe 5252 NUD.exe 2304 CKEFAY.exe 2304 CKEFAY.exe 3628 BAPHV.exe 3628 BAPHV.exe 3116 BDTDBB.exe 3116 BDTDBB.exe 2540 ZYSM.exe 2540 ZYSM.exe 828 VJIDTHL.exe 828 VJIDTHL.exe 5196 NEMGZX.exe 5196 NEMGZX.exe 1968 OHQ.exe 1968 OHQ.exe 240 DCAOXI.exe 240 DCAOXI.exe 4576 YXE.exe 4576 YXE.exe 5692 HYGD.exe 5692 HYGD.exe 2904 GIJ.exe 2904 GIJ.exe 2352 ZBZ.exe 2352 ZBZ.exe 4568 SECAJ.exe 4568 SECAJ.exe 4260 YEKNSEC.exe 4260 YEKNSEC.exe 4740 EAJWW.exe 4740 EAJWW.exe 1284 RKS.exe 1284 RKS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3368 wrote to memory of 3400 3368 2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe 87 PID 3400 wrote to memory of 3676 3400 cmd.exe 91 PID 3676 wrote to memory of 2844 3676 WZGNU.exe 93 PID 2844 wrote to memory of 5684 2844 cmd.exe 97 PID 5684 wrote to memory of 3212 5684 TXGXTG.exe 98 PID 3212 wrote to memory of 5172 3212 cmd.exe 102 PID 5172 wrote to memory of 5704 5172 INHO.exe 103 PID 5704 wrote to memory of 5676 5704 cmd.exe 107 PID 5676 wrote to memory of 3460 5676 WQPNGNR.exe 108 PID 3460 wrote to memory of 6140 3460 cmd.exe 112 PID 6140 wrote to memory of 1084 6140 PDWLLO.exe 113 PID 1084 wrote to memory of 4728 1084 cmd.exe 117 PID 4728 wrote to memory of 1500 4728 KZT.exe 118 PID 1500 wrote to memory of 5608 1500 cmd.exe 122 PID 5608 wrote to memory of 2108 5608 XBK.exe 123 PID 2108 wrote to memory of 4944 2108 cmd.exe 127 PID 4944 wrote to memory of 5996 4944 SXPD.exe 128 PID 5996 wrote to memory of 6076 5996 cmd.exe 132 PID 6076 wrote to memory of 1956 6076 ACHRV.exe 133 PID 1956 wrote to memory of 4876 1956 cmd.exe 137 PID 4876 wrote to memory of 4452 4876 CAU.exe 138 PID 4452 wrote to memory of 1964 4452 cmd.exe 142 PID 1964 wrote to memory of 2880 1964 MYAGKUH.exe 143 PID 2880 wrote to memory of 4676 2880 cmd.exe 147 PID 4676 wrote to memory of 1216 4676 GLFP.exe 148 PID 1216 wrote to memory of 5052 1216 cmd.exe 152 PID 5052 wrote to memory of 1068 5052 BYKYFU.exe 153 PID 1068 wrote to memory of 2032 1068 cmd.exe 157 PID 2032 wrote to memory of 5808 2032 AJMON.exe 158 PID 5808 wrote to memory of 5252 5808 cmd.exe 162 PID 5252 wrote to memory of 2024 5252 NUD.exe 163 PID 2024 wrote to memory of 2304 2024 cmd.exe 167 PID 2304 wrote to memory of 3148 2304 CKEFAY.exe 168 PID 3148 wrote to memory of 3628 3148 cmd.exe 172 PID 3628 wrote to memory of 4640 3628 BAPHV.exe 173 PID 4640 wrote to memory of 3116 4640 cmd.exe 177 PID 3116 wrote to memory of 2552 3116 BDTDBB.exe 178 PID 2552 wrote to memory of 2540 2552 cmd.exe 182 PID 2540 wrote to memory of 5388 2540 ZYSM.exe 183 PID 5388 wrote to memory of 828 5388 cmd.exe 187 PID 828 wrote to memory of 200 828 VJIDTHL.exe 188 PID 200 wrote to memory of 5196 200 cmd.exe 192 PID 5196 wrote to memory of 5592 5196 NEMGZX.exe 193 PID 5592 wrote to memory of 1968 5592 cmd.exe 197 PID 1968 wrote to memory of 396 1968 OHQ.exe 198 PID 396 wrote to memory of 240 396 cmd.exe 202 PID 240 wrote to memory of 2984 240 DCAOXI.exe 203 PID 2984 wrote to memory of 4576 2984 cmd.exe 207 PID 4576 wrote to memory of 5292 4576 YXE.exe 208 PID 5292 wrote to memory of 5692 5292 cmd.exe 212 PID 5692 wrote to memory of 3616 5692 HYGD.exe 213 PID 3616 wrote to memory of 2904 3616 cmd.exe 217 PID 2904 wrote to memory of 4184 2904 GIJ.exe 218 PID 4184 wrote to memory of 2352 4184 cmd.exe 222 PID 2352 wrote to memory of 2348 2352 ZBZ.exe 223 PID 2348 wrote to memory of 4568 2348 cmd.exe 227 PID 4568 wrote to memory of 5168 4568 SECAJ.exe 228 PID 5168 wrote to memory of 4260 5168 cmd.exe 232 PID 4260 wrote to memory of 3332 4260 YEKNSEC.exe 233 PID 3332 wrote to memory of 4740 3332 cmd.exe 237 PID 4740 wrote to memory of 3372 4740 EAJWW.exe 238 PID 3372 wrote to memory of 1284 3372 cmd.exe 242 PID 1284 wrote to memory of 5872 1284 RKS.exe 243 PID 5872 wrote to memory of 5144 5872 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_1920c7219b966b06604293473bb14de1_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXGXTG.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\TXGXTG.exeC:\windows\system\TXGXTG.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INHO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\SysWOW64\INHO.exeC:\windows\system32\INHO.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQPNGNR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\SysWOW64\WQPNGNR.exeC:\windows\system32\WQPNGNR.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XBK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\SysWOW64\XBK.exeC:\windows\system32\XBK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXPD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\system\SXPD.exeC:\windows\system\SXPD.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACHRV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\system\ACHRV.exeC:\windows\system\ACHRV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLFP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\GLFP.exeC:\windows\GLFP.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\system\NUD.exeC:\windows\system\NUD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAPHV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\system\BAPHV.exeC:\windows\system\BAPHV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDTDBB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\SysWOW64\BDTDBB.exeC:\windows\system32\BDTDBB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYSM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\system\ZYSM.exeC:\windows\system\ZYSM.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJIDTHL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\windows\SysWOW64\VJIDTHL.exeC:\windows\system32\VJIDTHL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYGD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\HYGD.exeC:\windows\HYGD.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\GIJ.exeC:\windows\GIJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SECAJ.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SECAJ.exeC:\windows\SECAJ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEKNSEC.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\system\YEKNSEC.exeC:\windows\system\YEKNSEC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RKS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\system\RKS.exeC:\windows\system\RKS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\VSYVX.exeC:\windows\VSYVX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "66⤵PID:936
-
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe67⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "68⤵PID:5452
-
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe69⤵
- Drops file in Windows directory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:5300 -
C:\windows\LWM.exeC:\windows\LWM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\windows\WPPC.exeC:\windows\WPPC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXRPI.exe.bat" "74⤵PID:2740
-
C:\windows\system\FXRPI.exeC:\windows\system\FXRPI.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSULOVZ.exe.bat" "76⤵PID:3024
-
C:\windows\SysWOW64\GSULOVZ.exeC:\windows\system32\GSULOVZ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "78⤵PID:688
-
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQIT.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5812 -
C:\windows\OQIT.exeC:\windows\OQIT.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe83⤵
- Executes dropped EXE
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\windows\JGQ.exeC:\windows\JGQ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJUCI.exe.bat" "86⤵PID:2264
-
C:\windows\SysWOW64\CJUCI.exeC:\windows\system32\CJUCI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKCPRNK.exe.bat" "88⤵PID:1780
-
C:\windows\HKCPRNK.exeC:\windows\HKCPRNK.exe89⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSIP.exe.bat" "90⤵PID:5972
-
C:\windows\LSIP.exeC:\windows\LSIP.exe91⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONNHNF.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\windows\system\ONNHNF.exeC:\windows\system\ONNHNF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAS.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1372 -
C:\windows\JAS.exeC:\windows\JAS.exe95⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTVJ.exe.bat" "96⤵PID:3944
-
C:\windows\system\UTVJ.exeC:\windows\system\UTVJ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBCJKF.exe.bat" "98⤵PID:6124
-
C:\windows\SysWOW64\YBCJKF.exeC:\windows\system32\YBCJKF.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWG.exe.bat" "100⤵PID:4332
-
C:\windows\SysWOW64\SWG.exeC:\windows\system32\SWG.exe101⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXIYYC.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\windows\CXIYYC.exeC:\windows\CXIYYC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFK.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4672 -
C:\windows\system\TFK.exeC:\windows\system\TFK.exe105⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKVV.exe.bat" "106⤵PID:4844
-
C:\windows\CKVV.exeC:\windows\CKVV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IFUDVZ.exe.bat" "108⤵PID:5988
-
C:\windows\IFUDVZ.exeC:\windows\IFUDVZ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVBE.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:932 -
C:\windows\SysWOW64\MVBE.exeC:\windows\system32\MVBE.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEHMMK.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2496 -
C:\windows\YEHMMK.exeC:\windows\YEHMMK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJIAVXW.exe.bat" "114⤵PID:5768
-
C:\windows\YJIAVXW.exeC:\windows\YJIAVXW.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHTVICE.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:416 -
C:\windows\XHTVICE.exeC:\windows\XHTVICE.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZWORJT.exe.bat" "118⤵PID:5112
-
C:\windows\SysWOW64\IZWORJT.exeC:\windows\system32\IZWORJT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSR.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4692 -
C:\windows\system\TSR.exeC:\windows\system\TSR.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-