Analysis
- max time kernel
95s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe
- Size 208KB
- Sample260920-2gjk3styb1
- SHA256 e538d92a7c483fda307629bd7b32481bacc614f40e2c7cacfd7df72ee975a8fd
- MD5 f2c9997bec916b5653dd16d757e15dac
- SHA1 e1035b6bdfc136f4e9b4ab836fc89f0e45694e19
- SHA512 a776b54f58bc77ba7499615b8c0ba7d0c333d317193c3148c3f20c3c0c2fe259dcf96ba74daf8d4b213301f9377ad338ecd8869fdbfa3f9855a1567bce395662
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfO4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOmkEj1
- TLSH T14D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2988 VQXXGZ.exe 3600 LZGRN.exe 4768 EUKVSHO.exe 5364 KRDQNM.exe 4520 INUQ.exe 572 EQLPYAH.exe 4504 YDQ.exe 2060 TYUIT.exe 4428 TENWUF.exe 2400 IZEJ.exe 4260 IEWX.exe 5716 DPNO.exe 1280 PIIHDX.exe 4740 JVMQOXQ.exe 260 YYWCZ.exe 4436 IYYHCPT.exe 5900 RHA.exe 4820 BEOHVVE.exe 5768 LUTBC.exe 2632 YFCSR.exe 6040 TSGBBOW.exe 5312 KBI.exe 4828 IBQCV.exe 3748 OWPDSQ.exe 912 JJU.exe 6084 YEDRND.exe 5676 PNFEZIH.exe 1628 KAKN.exe 712 TAMSMGY.exe 2092 KOX.exe 3020 FBBUF.exe 5512 ZOYDPC.exe 5972 JXA.exe 4684 PXIWB.exe 3296 YXKJNH.exe 1344 KNRJRR.exe 5552 RDSAYNN.exe 4412 DLGIKFB.exe 1072 YHL.exe 5404 SUIBE.exe 3496 CUKGIC.exe 1516 WQP.exe 2160 IYVYWU.exe 4588 DLAHHUG.exe 2372 SGRLA.exe 3312 LJVPFXQ.exe 2740 REUQK.exe 5296 NKSNR.exe 5860 TKABAMJ.exe 1728 MFEWFC.exe 820 SFLKWW.exe 3204 KIPOC.exe 4980 WBSHKB.exe 2296 HUVZKJS.exe 1088 NUD.exe 4324 TUKBK.exe 1056 ENFUTM.exe 1496 IVMU.exe 4596 OQLUCI.exe 3136 IDQ.exe 3232 DZVVW.exe 5564 NXIIEQA.exe 2656 TCIKO.exe 4648 OQNTYXT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IYVYWU.exe WQP.exe File opened for modification C:\windows\SysWOW64\IYVYWU.exe WQP.exe File created C:\windows\SysWOW64\REUQK.exe LJVPFXQ.exe File created C:\windows\SysWOW64\SQD.exe ZNZR.exe File opened for modification C:\windows\SysWOW64\SQD.exe ZNZR.exe File created C:\windows\SysWOW64\HXNAP.exe.bat VFKHHZ.exe File created C:\windows\SysWOW64\OWPDSQ.exe IBQCV.exe File opened for modification C:\windows\SysWOW64\DLAHHUG.exe IYVYWU.exe File created C:\windows\SysWOW64\HJHYLFU.exe WREFCX.exe File opened for modification C:\windows\SysWOW64\HLNZBW.exe SQD.exe File created C:\windows\SysWOW64\UGDEKTR.exe GVVF.exe File opened for modification C:\windows\SysWOW64\INUQ.exe KRDQNM.exe File created C:\windows\SysWOW64\PXIWB.exe JXA.exe File created C:\windows\SysWOW64\IYVYWU.exe.bat WQP.exe File created C:\windows\SysWOW64\IULJW.exe.bat CTE.exe File opened for modification C:\windows\SysWOW64\PIIHDX.exe DPNO.exe File created C:\windows\SysWOW64\ZOYDPC.exe.bat FBBUF.exe File created C:\windows\SysWOW64\IVMU.exe.bat ENFUTM.exe File created C:\windows\SysWOW64\VEBG.exe LVZ.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe HXKIBG.exe File created C:\windows\SysWOW64\SAWUXSR.exe.bat VDQXQIP.exe File created C:\windows\SysWOW64\INUQ.exe.bat KRDQNM.exe File opened for modification C:\windows\SysWOW64\IDQ.exe OQLUCI.exe File opened for modification C:\windows\SysWOW64\DZVVW.exe IDQ.exe File created C:\windows\SysWOW64\DLXGR.exe.bat OQNTYXT.exe File created C:\windows\SysWOW64\ZNZR.exe.bat MPZFBI.exe File created C:\windows\SysWOW64\LVZ.exe RIUSFU.exe File created C:\windows\SysWOW64\INUQ.exe KRDQNM.exe File created C:\windows\SysWOW64\PIIHDX.exe DPNO.exe File created C:\windows\SysWOW64\PIIHDX.exe.bat DPNO.exe File created C:\windows\SysWOW64\KNRJRR.exe.bat YXKJNH.exe File created C:\windows\SysWOW64\REUQK.exe.bat LJVPFXQ.exe File created C:\windows\SysWOW64\WBSHKB.exe KIPOC.exe File created C:\windows\SysWOW64\ENFUTM.exe TUKBK.exe File created C:\windows\SysWOW64\TCIKO.exe IKFR.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe IKFR.exe File created C:\windows\SysWOW64\HJHYLFU.exe.bat WREFCX.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe EJPO.exe File created C:\windows\SysWOW64\VQXXGZ.exe 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HJHYLFU.exe WREFCX.exe File opened for modification C:\windows\SysWOW64\SAWUXSR.exe VDQXQIP.exe File opened for modification C:\windows\SysWOW64\NSG.exe GBFSMYG.exe File created C:\windows\SysWOW64\EUKVSHO.exe LZGRN.exe File created C:\windows\SysWOW64\YXKJNH.exe.bat PXIWB.exe File opened for modification C:\windows\SysWOW64\HXNAP.exe VFKHHZ.exe File created C:\windows\SysWOW64\IVMU.exe ENFUTM.exe File opened for modification C:\windows\SysWOW64\OQLUCI.exe IVMU.exe File created C:\windows\SysWOW64\ZOYDPC.exe FBBUF.exe File opened for modification C:\windows\SysWOW64\PXIWB.exe JXA.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat IYVYWU.exe File created C:\windows\SysWOW64\ENFUTM.exe.bat TUKBK.exe File created C:\windows\SysWOW64\DZVVW.exe.bat IDQ.exe File opened for modification C:\windows\SysWOW64\CUKGIC.exe SUIBE.exe File created C:\windows\SysWOW64\VDQXQIP.exe HXKIBG.exe File created C:\windows\SysWOW64\KKXBOT.exe EJPO.exe File opened for modification C:\windows\SysWOW64\OLQWREI.exe KDKWF.exe File created C:\windows\SysWOW64\NSG.exe GBFSMYG.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe NKSNR.exe File opened for modification C:\windows\SysWOW64\YEDRND.exe JJU.exe File created C:\windows\SysWOW64\CUKGIC.exe SUIBE.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat WBSHKB.exe File opened for modification C:\windows\SysWOW64\VEBG.exe LVZ.exe File opened for modification C:\windows\SysWOW64\OWPDSQ.exe IBQCV.exe File created C:\windows\SysWOW64\DLAHHUG.exe IYVYWU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\LZGRN.exe VQXXGZ.exe File created C:\windows\system\SWIRRU.exe MVBE.exe File created C:\windows\TENWUF.exe TYUIT.exe File created C:\windows\DPNO.exe IEWX.exe File created C:\windows\system\ZAURXEJ.exe.bat NSG.exe File created C:\windows\system\TFHBM.exe.bat IMEI.exe File created C:\windows\ZLH.exe.bat EXCUMEQ.exe File created C:\windows\system\SDYN.exe ZAURXEJ.exe File created C:\windows\LUTBC.exe.bat BEOHVVE.exe File created C:\windows\YFCSR.exe LUTBC.exe File opened for modification C:\windows\CTE.exe RBJCFYM.exe File created C:\windows\GVVF.exe.bat YPV.exe File opened for modification C:\windows\TYUIT.exe YDQ.exe File created C:\windows\system\SFLKWW.exe MFEWFC.exe File created C:\windows\WREFCX.exe.bat DOABXID.exe File created C:\windows\system\OCRGM.exe.bat MEDTWW.exe File opened for modification C:\windows\TSGBBOW.exe YFCSR.exe File created C:\windows\system\JXA.exe ZOYDPC.exe File created C:\windows\system\SGRLA.exe.bat DLAHHUG.exe File opened for modification C:\windows\XPZ.exe PBYXL.exe File created C:\windows\KDKWF.exe.bat ZLH.exe File opened for modification C:\windows\KRDQNM.exe EUKVSHO.exe File created C:\windows\BEOHVVE.exe.bat RHA.exe File created C:\windows\MPZFBI.exe HJHYLFU.exe File created C:\windows\SBBGSZJ.exe SWIRRU.exe File opened for modification C:\windows\system\EJPO.exe SBBGSZJ.exe File created C:\windows\KRDQNM.exe.bat EUKVSHO.exe File created C:\windows\system\IEWX.exe.bat IZEJ.exe File opened for modification C:\windows\DPNO.exe IEWX.exe File created C:\windows\system\RHA.exe.bat IYYHCPT.exe File created C:\windows\system\IBQCV.exe KBI.exe File created C:\windows\system\SWIRRU.exe.bat MVBE.exe File created C:\windows\LUTBC.exe BEOHVVE.exe File created C:\windows\YHL.exe.bat DLGIKFB.exe File created C:\windows\system\JJOB.exe.bat HLNZBW.exe File opened for modification C:\windows\RHBJYW.exe YEXFSGZ.exe File created C:\windows\CTE.exe RBJCFYM.exe File opened for modification C:\windows\system\AOD.exe LIXDHPA.exe File created C:\windows\NXIIEQA.exe DZVVW.exe File opened for modification C:\windows\system\JJOB.exe HLNZBW.exe File created C:\windows\system\PBYXL.exe.bat WGV.exe File created C:\windows\GVVF.exe YPV.exe File created C:\windows\BEOHVVE.exe RHA.exe File opened for modification C:\windows\RIUSFU.exe QFQWAEM.exe File opened for modification C:\windows\system\UCQBVHZ.exe OCRGM.exe File created C:\windows\system\CZEUGDQ.exe.bat RHBJYW.exe File created C:\windows\HXKIBG.exe FZRGD.exe File created C:\windows\JVTUX.exe.bat HXNAP.exe File created C:\windows\system\TFHBM.exe IMEI.exe File created C:\windows\system\LZGRN.exe.bat VQXXGZ.exe File opened for modification C:\windows\system\IBQCV.exe KBI.exe File created C:\windows\system\PBYXL.exe WGV.exe File created C:\windows\system\SDYN.exe.bat ZAURXEJ.exe File created C:\windows\KOX.exe.bat TAMSMGY.exe File created C:\windows\system\SFLKWW.exe.bat MFEWFC.exe File created C:\windows\RHBJYW.exe YEXFSGZ.exe File created C:\windows\TYUIT.exe.bat YDQ.exe File created C:\windows\TSGBBOW.exe YFCSR.exe File created C:\windows\LBBOO.exe.bat AIY.exe File opened for modification C:\windows\HXKIBG.exe FZRGD.exe File created C:\windows\HXKIBG.exe.bat FZRGD.exe File created C:\windows\OIWKRE.exe.bat SDYN.exe File created C:\windows\WGV.exe.bat JWEDR.exe File opened for modification C:\windows\system\TFHBM.exe IMEI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2044 cmd.exe 700 cmd.exe 4136 cmd.exe 2468 cmd.exe 5028 cmd.exe 3264 cmd.exe 4452 cmd.exe 916 cmd.exe 3464 cmd.exe 5192 cmd.exe 1492 cmd.exe 3196 cmd.exe 4860 cmd.exe 1592 cmd.exe 6020 cmd.exe 5324 cmd.exe 3644 cmd.exe 3276 cmd.exe 6012 cmd.exe 2504 cmd.exe 4224 cmd.exe 3452 cmd.exe 4848 cmd.exe 2344 cmd.exe 4196 cmd.exe 6032 cmd.exe 3784 cmd.exe 5792 cmd.exe 3696 cmd.exe 3788 cmd.exe 5916 cmd.exe 2676 cmd.exe 4256 cmd.exe 5948 cmd.exe 2764 cmd.exe 1360 cmd.exe 3180 cmd.exe 2664 cmd.exe 5960 cmd.exe 3728 cmd.exe 2448 cmd.exe 1272 cmd.exe 5112 cmd.exe 1340 cmd.exe 3292 cmd.exe 1332 cmd.exe 1952 cmd.exe 2444 cmd.exe 1676 cmd.exe 2376 cmd.exe 1192 cmd.exe 2868 cmd.exe 1296 cmd.exe 5608 cmd.exe 5924 cmd.exe 2884 cmd.exe 6044 cmd.exe 1868 cmd.exe 4672 cmd.exe 4140 cmd.exe 4804 cmd.exe 2028 cmd.exe 5876 cmd.exe 3084 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2248 2532 WerFault.exe 87 3408 2988 WerFault.exe 93 3404 3600 WerFault.exe 99 1496 4768 WerFault.exe 104 2860 5364 WerFault.exe 109 472 4520 WerFault.exe 114 4392 572 WerFault.exe 119 2692 4504 WerFault.exe 124 2264 2060 WerFault.exe 129 4844 4428 WerFault.exe 134 5580 2400 WerFault.exe 139 6000 4260 WerFault.exe 144 4136 5716 WerFault.exe 149 3696 1280 WerFault.exe 154 244 4740 WerFault.exe 159 696 260 WerFault.exe 164 2996 4436 WerFault.exe 169 3644 5900 WerFault.exe 174 2688 4820 WerFault.exe 179 2780 5768 WerFault.exe 184 2812 2632 WerFault.exe 189 5556 6040 WerFault.exe 194 5092 5312 WerFault.exe 199 2260 4828 WerFault.exe 204 5252 3748 WerFault.exe 209 992 912 WerFault.exe 214 4580 6084 WerFault.exe 219 2012 5676 WerFault.exe 224 3712 1628 WerFault.exe 229 5036 712 WerFault.exe 234 5916 2092 WerFault.exe 239 4676 3020 WerFault.exe 244 4632 5512 WerFault.exe 249 4128 5972 WerFault.exe 254 2380 4684 WerFault.exe 259 5644 3296 WerFault.exe 264 2640 1344 WerFault.exe 269 3092 5552 WerFault.exe 274 3004 4412 WerFault.exe 279 5988 1072 WerFault.exe 284 5620 5404 WerFault.exe 289 1840 3496 WerFault.exe 294 3084 1516 WerFault.exe 299 4816 2160 WerFault.exe 304 2652 4588 WerFault.exe 309 1624 2372 WerFault.exe 314 1460 3312 WerFault.exe 319 2948 2740 WerFault.exe 324 244 5296 WerFault.exe 329 1148 5860 WerFault.exe 334 6028 1728 WerFault.exe 339 1488 820 WerFault.exe 344 4632 3204 WerFault.exe 349 2820 4980 WerFault.exe 354 3688 2296 WerFault.exe 359 5540 1088 WerFault.exe 364 5292 4324 WerFault.exe 369 5112 1056 WerFault.exe 374 3908 1496 WerFault.exe 379 3264 4596 WerFault.exe 384 3760 3136 WerFault.exe 389 2512 3232 WerFault.exe 394 4128 5564 WerFault.exe 399 3928 3800 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGRLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPZFBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEXFSGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAWUXSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIXDHPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOAIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKABAMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXKJNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFQWAEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUVZKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGDEKTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFCSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOYDPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFEWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFKHHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQXXGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TENWUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXKIBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBYXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe 2532 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe 2988 VQXXGZ.exe 2988 VQXXGZ.exe 3600 LZGRN.exe 3600 LZGRN.exe 4768 EUKVSHO.exe 4768 EUKVSHO.exe 5364 KRDQNM.exe 5364 KRDQNM.exe 4520 INUQ.exe 4520 INUQ.exe 572 EQLPYAH.exe 572 EQLPYAH.exe 4504 YDQ.exe 4504 YDQ.exe 2060 TYUIT.exe 2060 TYUIT.exe 4428 TENWUF.exe 4428 TENWUF.exe 2400 IZEJ.exe 2400 IZEJ.exe 4260 IEWX.exe 4260 IEWX.exe 5716 DPNO.exe 5716 DPNO.exe 1280 PIIHDX.exe 1280 PIIHDX.exe 4740 JVMQOXQ.exe 4740 JVMQOXQ.exe 260 YYWCZ.exe 260 YYWCZ.exe 4436 IYYHCPT.exe 4436 IYYHCPT.exe 5900 RHA.exe 5900 RHA.exe 4820 BEOHVVE.exe 4820 BEOHVVE.exe 5768 LUTBC.exe 5768 LUTBC.exe 2632 YFCSR.exe 2632 YFCSR.exe 6040 TSGBBOW.exe 6040 TSGBBOW.exe 5312 KBI.exe 5312 KBI.exe 4828 IBQCV.exe 4828 IBQCV.exe 3748 OWPDSQ.exe 3748 OWPDSQ.exe 912 JJU.exe 912 JJU.exe 6084 YEDRND.exe 6084 YEDRND.exe 5676 PNFEZIH.exe 5676 PNFEZIH.exe 1628 KAKN.exe 1628 KAKN.exe 712 TAMSMGY.exe 712 TAMSMGY.exe 2092 KOX.exe 2092 KOX.exe 3020 FBBUF.exe 3020 FBBUF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2532 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe 2532 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe 2988 VQXXGZ.exe 2988 VQXXGZ.exe 3600 LZGRN.exe 3600 LZGRN.exe 4768 EUKVSHO.exe 4768 EUKVSHO.exe 5364 KRDQNM.exe 5364 KRDQNM.exe 4520 INUQ.exe 4520 INUQ.exe 572 EQLPYAH.exe 572 EQLPYAH.exe 4504 YDQ.exe 4504 YDQ.exe 2060 TYUIT.exe 2060 TYUIT.exe 4428 TENWUF.exe 4428 TENWUF.exe 2400 IZEJ.exe 2400 IZEJ.exe 4260 IEWX.exe 4260 IEWX.exe 5716 DPNO.exe 5716 DPNO.exe 1280 PIIHDX.exe 1280 PIIHDX.exe 4740 JVMQOXQ.exe 4740 JVMQOXQ.exe 260 YYWCZ.exe 260 YYWCZ.exe 4436 IYYHCPT.exe 4436 IYYHCPT.exe 5900 RHA.exe 5900 RHA.exe 4820 BEOHVVE.exe 4820 BEOHVVE.exe 5768 LUTBC.exe 5768 LUTBC.exe 2632 YFCSR.exe 2632 YFCSR.exe 6040 TSGBBOW.exe 6040 TSGBBOW.exe 5312 KBI.exe 5312 KBI.exe 4828 IBQCV.exe 4828 IBQCV.exe 3748 OWPDSQ.exe 3748 OWPDSQ.exe 912 JJU.exe 912 JJU.exe 6084 YEDRND.exe 6084 YEDRND.exe 5676 PNFEZIH.exe 5676 PNFEZIH.exe 1628 KAKN.exe 1628 KAKN.exe 712 TAMSMGY.exe 712 TAMSMGY.exe 2092 KOX.exe 2092 KOX.exe 3020 FBBUF.exe 3020 FBBUF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 3784 2532 2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe 89 PID 3784 wrote to memory of 2988 3784 cmd.exe 93 PID 2988 wrote to memory of 5792 2988 VQXXGZ.exe 95 PID 5792 wrote to memory of 3600 5792 cmd.exe 99 PID 3600 wrote to memory of 5132 3600 LZGRN.exe 100 PID 5132 wrote to memory of 4768 5132 cmd.exe 104 PID 4768 wrote to memory of 6056 4768 EUKVSHO.exe 105 PID 6056 wrote to memory of 5364 6056 cmd.exe 109 PID 5364 wrote to memory of 2144 5364 KRDQNM.exe 110 PID 2144 wrote to memory of 4520 2144 cmd.exe 114 PID 4520 wrote to memory of 4456 4520 INUQ.exe 115 PID 4456 wrote to memory of 572 4456 cmd.exe 119 PID 572 wrote to memory of 2580 572 EQLPYAH.exe 120 PID 2580 wrote to memory of 4504 2580 cmd.exe 124 PID 4504 wrote to memory of 1492 4504 YDQ.exe 125 PID 1492 wrote to memory of 2060 1492 cmd.exe 129 PID 2060 wrote to memory of 4556 2060 TYUIT.exe 130 PID 4556 wrote to memory of 4428 4556 cmd.exe 134 PID 4428 wrote to memory of 4804 4428 TENWUF.exe 135 PID 4804 wrote to memory of 2400 4804 cmd.exe 139 PID 2400 wrote to memory of 5028 2400 IZEJ.exe 140 PID 5028 wrote to memory of 4260 5028 cmd.exe 144 PID 4260 wrote to memory of 2124 4260 IEWX.exe 145 PID 2124 wrote to memory of 5716 2124 cmd.exe 149 PID 5716 wrote to memory of 6032 5716 DPNO.exe 150 PID 6032 wrote to memory of 1280 6032 cmd.exe 154 PID 1280 wrote to memory of 2816 1280 PIIHDX.exe 155 PID 2816 wrote to memory of 4740 2816 cmd.exe 159 PID 4740 wrote to memory of 4652 4740 JVMQOXQ.exe 160 PID 4652 wrote to memory of 260 4652 cmd.exe 164 PID 260 wrote to memory of 1340 260 YYWCZ.exe 165 PID 1340 wrote to memory of 4436 1340 cmd.exe 169 PID 4436 wrote to memory of 980 4436 IYYHCPT.exe 170 PID 980 wrote to memory of 5900 980 cmd.exe 174 PID 5900 wrote to memory of 3952 5900 RHA.exe 175 PID 3952 wrote to memory of 4820 3952 cmd.exe 179 PID 4820 wrote to memory of 3292 4820 BEOHVVE.exe 180 PID 3292 wrote to memory of 5768 3292 cmd.exe 184 PID 5768 wrote to memory of 4688 5768 LUTBC.exe 185 PID 4688 wrote to memory of 2632 4688 cmd.exe 189 PID 2632 wrote to memory of 5828 2632 YFCSR.exe 190 PID 5828 wrote to memory of 6040 5828 cmd.exe 194 PID 6040 wrote to memory of 4644 6040 TSGBBOW.exe 195 PID 4644 wrote to memory of 5312 4644 cmd.exe 199 PID 5312 wrote to memory of 1692 5312 KBI.exe 200 PID 1692 wrote to memory of 4828 1692 cmd.exe 204 PID 4828 wrote to memory of 5604 4828 IBQCV.exe 205 PID 5604 wrote to memory of 3748 5604 cmd.exe 209 PID 3748 wrote to memory of 4488 3748 OWPDSQ.exe 210 PID 4488 wrote to memory of 912 4488 cmd.exe 214 PID 912 wrote to memory of 4360 912 JJU.exe 215 PID 4360 wrote to memory of 6084 4360 cmd.exe 219 PID 6084 wrote to memory of 1296 6084 YEDRND.exe 220 PID 1296 wrote to memory of 5676 1296 cmd.exe 224 PID 5676 wrote to memory of 4764 5676 PNFEZIH.exe 225 PID 4764 wrote to memory of 1628 4764 cmd.exe 229 PID 1628 wrote to memory of 4072 1628 KAKN.exe 230 PID 4072 wrote to memory of 712 4072 cmd.exe 234 PID 712 wrote to memory of 5700 712 TAMSMGY.exe 235 PID 5700 wrote to memory of 2092 5700 cmd.exe 239 PID 2092 wrote to memory of 5400 2092 KOX.exe 240 PID 5400 wrote to memory of 3020 5400 cmd.exe 244 PID 3020 wrote to memory of 2028 3020 FBBUF.exe 245 PID 2028 wrote to memory of 5512 2028 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-20_f2c9997bec916b5653dd16d757e15dac_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQXXGZ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\SysWOW64\VQXXGZ.exeC:\windows\system32\VQXXGZ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZGRN.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\system\LZGRN.exeC:\windows\system\LZGRN.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUKVSHO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\SysWOW64\EUKVSHO.exeC:\windows\system32\EUKVSHO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRDQNM.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\KRDQNM.exeC:\windows\KRDQNM.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INUQ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\SysWOW64\INUQ.exeC:\windows\system32\INUQ.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQLPYAH.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\EQLPYAH.exeC:\windows\EQLPYAH.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\windows\system\YDQ.exeC:\windows\system\YDQ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYUIT.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\TYUIT.exeC:\windows\TYUIT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TENWUF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\TENWUF.exeC:\windows\TENWUF.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZEJ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\IZEJ.exeC:\windows\system\IZEJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEWX.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\system\IEWX.exeC:\windows\system\IEWX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DPNO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\DPNO.exeC:\windows\DPNO.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIIHDX.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\SysWOW64\PIIHDX.exeC:\windows\system32\PIIHDX.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVMQOXQ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\JVMQOXQ.exeC:\windows\JVMQOXQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYWCZ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\YYWCZ.exeC:\windows\YYWCZ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYHCPT.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\IYYHCPT.exeC:\windows\IYYHCPT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\windows\system\RHA.exeC:\windows\system\RHA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUTBC.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\LUTBC.exeC:\windows\LUTBC.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFCSR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\YFCSR.exeC:\windows\YFCSR.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSGBBOW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\TSGBBOW.exeC:\windows\TSGBBOW.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KBI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\KBI.exeC:\windows\KBI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEDRND.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\YEDRND.exeC:\windows\system32\YEDRND.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNFEZIH.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\system\PNFEZIH.exeC:\windows\system\PNFEZIH.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\KAKN.exeC:\windows\KAKN.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\KOX.exeC:\windows\KOX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBBUF.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\SysWOW64\FBBUF.exeC:\windows\system32\FBBUF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOYDPC.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\SysWOW64\ZOYDPC.exeC:\windows\system32\ZOYDPC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXA.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1332 -
C:\windows\system\JXA.exeC:\windows\system\JXA.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXIWB.exe.bat" "68⤵PID:4660
-
C:\windows\SysWOW64\PXIWB.exeC:\windows\system32\PXIWB.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXKJNH.exe.bat" "70⤵PID:4312
-
C:\windows\SysWOW64\YXKJNH.exeC:\windows\system32\YXKJNH.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "72⤵PID:2620
-
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe73⤵
- Executes dropped EXE
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDSAYNN.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3696 -
C:\windows\RDSAYNN.exeC:\windows\RDSAYNN.exe75⤵
- Executes dropped EXE
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLGIKFB.exe.bat" "76⤵PID:5128
-
C:\windows\DLGIKFB.exeC:\windows\DLGIKFB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3196 -
C:\windows\YHL.exeC:\windows\YHL.exe79⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4516 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "82⤵PID:2864
-
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe83⤵
- Executes dropped EXE
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:6072 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "86⤵PID:3424
-
C:\windows\SysWOW64\IYVYWU.exeC:\windows\system32\IYVYWU.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "88⤵PID:3224
-
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGRLA.exe.bat" "90⤵PID:5964
-
C:\windows\system\SGRLA.exeC:\windows\system\SGRLA.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJVPFXQ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\windows\system\LJVPFXQ.exeC:\windows\system\LJVPFXQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "94⤵PID:1476
-
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe95⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKSNR.exe.bat" "96⤵PID:628
-
C:\windows\SysWOW64\NKSNR.exeC:\windows\system32\NKSNR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "98⤵PID:4308
-
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFEWFC.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5408 -
C:\windows\system\MFEWFC.exeC:\windows\system\MFEWFC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFLKWW.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\system\SFLKWW.exeC:\windows\system\SFLKWW.exe103⤵
- Executes dropped EXE
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\windows\KIPOC.exeC:\windows\KIPOC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "106⤵PID:4320
-
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5580 -
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4860 -
C:\windows\system\NUD.exeC:\windows\system\NUD.exe111⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5608 -
C:\windows\TUKBK.exeC:\windows\TUKBK.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "114⤵PID:3620
-
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "116⤵PID:4368
-
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5876 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDQ.exe.bat" "120⤵PID:4868
-
C:\windows\SysWOW64\IDQ.exeC:\windows\system32\IDQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-