Analysis
- max time kernel
72s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe
- Size 208KB
- Sample260924-b99d4abe96
- SHA256 ae5fe6bc12f25d1d3671cb4e6dc27b209385776daee8ac8d50ecedaf9e51ced7
- MD5 bf643395e0ab18ceb12a1d8bcc9c02de
- SHA1 20c76afd7f157bd43241ce8528d74f8b17ed1eb0
- SHA512 8319fc7ed48178b8f6223f66c393acc72050b2a3335ba54bb1a4dfc48454d619297b782c6efe1346c63c64bb806d60b8923c720ce24c879dc7fe3cc0aec2c880
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfN4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOlkEj1
- TLSH T1EE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1800 VOOKRP.exe 1284 CCHXGJ.exe 4176 RXQK.exe 3988 KAC.exe 2848 UYIAM.exe 2184 MTLE.exe 3808 NWPZEI.exe 3348 IJU.exe 2804 VUD.exe 6100 DHPOGRX.exe 5372 HKNJF.exe 4584 PQAQQ.exe 4856 UVKF.exe 108 DEMKS.exe 3704 COXA.exe 3208 MMD.exe 3556 XFK.exe 3940 BNZFDJ.exe 5300 PICGJ.exe 3356 MIMJV.exe 1928 KTPZ.exe 6132 DWTUJFY.exe 4568 NUGPR.exe 5752 AFPNF.exe 5968 BATJKOD.exe 3732 TDWN.exe 4740 POND.exe 4908 WEODLCP.exe 1932 VPRT.exe 2708 FMEN.exe 3976 XPIJO.exe 3592 TSQHC.exe 4632 LVUDIHS.exe 5268 PLBLU.exe 5844 QGNH.exe 304 FWOGG.exe 680 CCYWWG.exe 1796 TKABAMJ.exe 5900 KVDRJS.exe 5696 LYP.exe 3304 HDZ.exe 2504 WMABLZR.exe 4680 XPEX.exe 5928 KZUVFZV.exe 2256 FNZ.exe 764 OVBKSXM.exe 4884 KYJJG.exe 5392 IQMZ.exe 4092 QZNQWJT.exe 2844 CPCY.exe 556 EMHSPKP.exe 3232 CXKIYQ.exe 3396 WQATHQ.exe 5408 FYCYLOW.exe 1464 SBY.exe 4688 WREFCX.exe 6040 GPS.exe 4368 RHVK.exe 5256 KCZ.exe 3656 OSFOKV.exe 5160 AAM.exe 1624 CYR.exe 3760 ITR.exe 1880 CHVAS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OSFOKV.exe KCZ.exe File created C:\windows\SysWOW64\VHRCI.exe OEIYXOG.exe File created C:\windows\SysWOW64\OGCR.exe USXIUCW.exe File opened for modification C:\windows\SysWOW64\DHPOGRX.exe VUD.exe File opened for modification C:\windows\SysWOW64\COXA.exe DEMKS.exe File created C:\windows\SysWOW64\KTPZ.exe MIMJV.exe File opened for modification C:\windows\SysWOW64\WMABLZR.exe HDZ.exe File created C:\windows\SysWOW64\FYCYLOW.exe.bat WQATHQ.exe File created C:\windows\SysWOW64\KCZ.exe RHVK.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe PILFG.exe File created C:\windows\SysWOW64\SWG.exe.bat UYVQZ.exe File created C:\windows\SysWOW64\COXA.exe DEMKS.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe BNZFDJ.exe File created C:\windows\SysWOW64\MIMJV.exe PICGJ.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe PICGJ.exe File opened for modification C:\windows\SysWOW64\WEODLCP.exe POND.exe File created C:\windows\SysWOW64\KCZ.exe.bat RHVK.exe File opened for modification C:\windows\SysWOW64\SWG.exe UYVQZ.exe File opened for modification C:\windows\SysWOW64\TRKWZUL.exe SWG.exe File created C:\windows\SysWOW64\MMD.exe COXA.exe File opened for modification C:\windows\SysWOW64\MMD.exe COXA.exe File created C:\windows\SysWOW64\MIMJV.exe.bat PICGJ.exe File opened for modification C:\windows\SysWOW64\CPCY.exe QZNQWJT.exe File opened for modification C:\windows\SysWOW64\OSFOKV.exe KCZ.exe File created C:\windows\SysWOW64\CCHXGJ.exe.bat VOOKRP.exe File created C:\windows\SysWOW64\DHPOGRX.exe VUD.exe File created C:\windows\SysWOW64\PICGJ.exe.bat BNZFDJ.exe File opened for modification C:\windows\SysWOW64\FYCYLOW.exe WQATHQ.exe File created C:\windows\SysWOW64\ITR.exe.bat CYR.exe File created C:\windows\SysWOW64\VHRCI.exe.bat OEIYXOG.exe File created C:\windows\SysWOW64\XNRLN.exe.bat ONPG.exe File opened for modification C:\windows\SysWOW64\OGCR.exe USXIUCW.exe File created C:\windows\SysWOW64\NUGPR.exe DWTUJFY.exe File created C:\windows\SysWOW64\TKABAMJ.exe CCYWWG.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe TKABAMJ.exe File opened for modification C:\windows\SysWOW64\OJEUR.exe PQBMIK.exe File opened for modification C:\windows\SysWOW64\HKP.exe VHRCI.exe File created C:\windows\SysWOW64\FYCYLOW.exe WQATHQ.exe File opened for modification C:\windows\SysWOW64\KCZ.exe RHVK.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe HKP.exe File created C:\windows\SysWOW64\TRKWZUL.exe SWG.exe File created C:\windows\SysWOW64\PICGJ.exe BNZFDJ.exe File created C:\windows\SysWOW64\OSFOKV.exe.bat KCZ.exe File created C:\windows\SysWOW64\ITR.exe CYR.exe File created C:\windows\SysWOW64\TQRFSXP.exe.bat PILFG.exe File created C:\windows\SysWOW64\TRKWZUL.exe.bat SWG.exe File created C:\windows\SysWOW64\CCYWWG.exe.bat FWOGG.exe File created C:\windows\SysWOW64\DHPOGRX.exe.bat VUD.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat HDZ.exe File created C:\windows\SysWOW64\GPS.exe.bat WREFCX.exe File opened for modification C:\windows\SysWOW64\GPS.exe WREFCX.exe File opened for modification C:\windows\SysWOW64\RHVK.exe GPS.exe File opened for modification C:\windows\SysWOW64\ITR.exe CYR.exe File created C:\windows\SysWOW64\OJEUR.exe PQBMIK.exe File opened for modification C:\windows\SysWOW64\VHRCI.exe OEIYXOG.exe File created C:\windows\SysWOW64\TQRFSXP.exe PILFG.exe File created C:\windows\SysWOW64\BVR.exe TQRFSXP.exe File created C:\windows\SysWOW64\OGCR.exe.bat USXIUCW.exe File created C:\windows\SysWOW64\CCHXGJ.exe VOOKRP.exe File created C:\windows\SysWOW64\MMD.exe.bat COXA.exe File opened for modification C:\windows\SysWOW64\KTPZ.exe MIMJV.exe File opened for modification C:\windows\SysWOW64\TKABAMJ.exe CCYWWG.exe File opened for modification C:\windows\SysWOW64\UYVQZ.exe BVR.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat BVR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\TPNDMB.exe PHG.exe File created C:\windows\system\RXQK.exe.bat CCHXGJ.exe File created C:\windows\PQAQQ.exe.bat HKNJF.exe File created C:\windows\system\TDWN.exe BATJKOD.exe File opened for modification C:\windows\TSQHC.exe XPIJO.exe File opened for modification C:\windows\system\FWOGG.exe QGNH.exe File opened for modification C:\windows\system\IQMZ.exe KYJJG.exe File opened for modification C:\windows\SBY.exe FYCYLOW.exe File opened for modification C:\windows\system\VSMNQE.exe SKF.exe File created C:\windows\system\NWPZEI.exe MTLE.exe File opened for modification C:\windows\HDZ.exe LYP.exe File created C:\windows\system\XPEX.exe.bat WMABLZR.exe File created C:\windows\OVBKSXM.exe.bat FNZ.exe File created C:\windows\system\WVXI.exe.bat VSMNQE.exe File created C:\windows\system\PHG.exe UMCTXJP.exe File created C:\windows\system\VOOKRP.exe.bat 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe File created C:\windows\VUD.exe.bat IJU.exe File opened for modification C:\windows\system\XPEX.exe WMABLZR.exe File created C:\windows\system\PQBMIK.exe WVXI.exe File opened for modification C:\windows\UGJFOE.exe OGCR.exe File created C:\windows\UYIAM.exe KAC.exe File created C:\windows\IJU.exe.bat NWPZEI.exe File created C:\windows\BNZFDJ.exe.bat XFK.exe File created C:\windows\POND.exe.bat TDWN.exe File created C:\windows\system\EMHSPKP.exe.bat CPCY.exe File created C:\windows\WREFCX.exe.bat SBY.exe File created C:\windows\UGJFOE.exe OGCR.exe File created C:\windows\system\UVKF.exe.bat PQAQQ.exe File created C:\windows\BNZFDJ.exe XFK.exe File created C:\windows\HDZ.exe.bat LYP.exe File created C:\windows\system\KYJJG.exe.bat OVBKSXM.exe File created C:\windows\system\EMHSPKP.exe CPCY.exe File opened for modification C:\windows\system\OEIYXOG.exe OJEUR.exe File opened for modification C:\windows\FNZ.exe KZUVFZV.exe File created C:\windows\FNZ.exe.bat KZUVFZV.exe File opened for modification C:\windows\system\PQBMIK.exe WVXI.exe File opened for modification C:\windows\system\NWPZEI.exe MTLE.exe File created C:\windows\system\TDWN.exe.bat BATJKOD.exe File opened for modification C:\windows\KZUVFZV.exe XPEX.exe File opened for modification C:\windows\QZNQWJT.exe IQMZ.exe File created C:\windows\system\MTLE.exe.bat UYIAM.exe File created C:\windows\system\PLBLU.exe.bat LVUDIHS.exe File created C:\windows\system\IQMZ.exe KYJJG.exe File opened for modification C:\windows\BNZFDJ.exe XFK.exe File created C:\windows\system\FMEN.exe.bat VPRT.exe File created C:\windows\XPIJO.exe.bat FMEN.exe File created C:\windows\QGNH.exe.bat PLBLU.exe File created C:\windows\LYP.exe KVDRJS.exe File created C:\windows\system\CXKIYQ.exe.bat EMHSPKP.exe File opened for modification C:\windows\system\WVXI.exe VSMNQE.exe File opened for modification C:\windows\LYP.exe KVDRJS.exe File created C:\windows\LYP.exe.bat KVDRJS.exe File created C:\windows\HDZ.exe LYP.exe File opened for modification C:\windows\YPV.exe TPNDMB.exe File created C:\windows\GVVF.exe.bat YPV.exe File opened for modification C:\windows\system\BQMP.exe GVVF.exe File opened for modification C:\windows\system\FMEN.exe VPRT.exe File created C:\windows\system\WQATHQ.exe.bat CXKIYQ.exe File created C:\windows\CHVAS.exe ITR.exe File created C:\windows\system\WVXI.exe VSMNQE.exe File created C:\windows\system\KAC.exe.bat RXQK.exe File created C:\windows\system\FWOGG.exe.bat QGNH.exe File created C:\windows\system\WQATHQ.exe CXKIYQ.exe File opened for modification C:\windows\system\PHG.exe UMCTXJP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5560 cmd.exe 4700 cmd.exe 5512 cmd.exe 3800 cmd.exe 2052 cmd.exe 4904 cmd.exe 1908 cmd.exe 3220 cmd.exe 3168 cmd.exe 6104 cmd.exe 3280 cmd.exe 1380 cmd.exe 4488 cmd.exe 4232 cmd.exe 4848 cmd.exe 2340 cmd.exe 5920 cmd.exe 2112 cmd.exe 2948 cmd.exe 2704 cmd.exe 5520 cmd.exe 1736 cmd.exe 5248 cmd.exe 4756 cmd.exe 5552 cmd.exe 4148 cmd.exe 3604 cmd.exe 1708 cmd.exe 952 cmd.exe 4180 cmd.exe 4360 cmd.exe 4320 cmd.exe 3660 cmd.exe 4692 cmd.exe 2888 cmd.exe 5832 cmd.exe 4084 cmd.exe 408 cmd.exe 4704 cmd.exe 5056 cmd.exe 5096 cmd.exe 4512 cmd.exe 936 cmd.exe 2864 cmd.exe 3964 cmd.exe 5892 cmd.exe 5648 cmd.exe 4268 cmd.exe 3196 cmd.exe 4892 cmd.exe 5656 cmd.exe 6096 cmd.exe 1388 cmd.exe 1420 cmd.exe 2908 cmd.exe 4836 cmd.exe 1628 cmd.exe 2768 cmd.exe 1064 cmd.exe 4936 cmd.exe 2432 cmd.exe 2128 cmd.exe 4304 cmd.exe 3616 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4656 2400 WerFault.exe 87 1936 1800 WerFault.exe 93 1388 1284 WerFault.exe 99 5748 4176 WerFault.exe 104 3796 3988 WerFault.exe 109 1524 2848 WerFault.exe 114 3936 2184 WerFault.exe 119 3516 3808 WerFault.exe 124 5964 3348 WerFault.exe 129 2736 2804 WerFault.exe 134 3548 6100 WerFault.exe 139 4696 5372 WerFault.exe 144 1092 4584 WerFault.exe 149 1880 4856 WerFault.exe 154 880 108 WerFault.exe 159 1844 3704 WerFault.exe 164 4948 3208 WerFault.exe 169 4332 3556 WerFault.exe 174 3860 3940 WerFault.exe 179 4556 5300 WerFault.exe 184 1308 3356 WerFault.exe 189 2348 1928 WerFault.exe 194 724 6132 WerFault.exe 199 408 4568 WerFault.exe 204 3964 5752 WerFault.exe 209 2332 5968 WerFault.exe 214 5252 3732 WerFault.exe 219 3336 4740 WerFault.exe 224 5696 4908 WerFault.exe 229 4624 1932 WerFault.exe 234 2696 2708 WerFault.exe 239 3232 3976 WerFault.exe 244 2752 3592 WerFault.exe 249 5112 4632 WerFault.exe 254 5520 5268 WerFault.exe 259 5548 5844 WerFault.exe 264 5396 304 WerFault.exe 270 1364 680 WerFault.exe 275 484 1796 WerFault.exe 280 6096 5900 WerFault.exe 285 4348 5696 WerFault.exe 290 4256 3304 WerFault.exe 295 2340 2504 WerFault.exe 300 1212 4680 WerFault.exe 305 3496 5928 WerFault.exe 310 1136 2256 WerFault.exe 315 1388 764 WerFault.exe 320 2468 4884 WerFault.exe 325 4344 5392 WerFault.exe 330 3172 4092 WerFault.exe 335 2084 2844 WerFault.exe 340 4200 556 WerFault.exe 345 5104 3232 WerFault.exe 350 3364 3396 WerFault.exe 355 4700 5408 WerFault.exe 359 6112 1464 WerFault.exe 365 3964 4688 WerFault.exe 370 624 6040 WerFault.exe 375 1832 4368 WerFault.exe 380 5936 5256 WerFault.exe 385 2196 3656 WerFault.exe 390 492 5160 WerFault.exe 395 4840 1624 WerFault.exe 400 2532 3760 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIMJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PICGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZUVFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVBKSXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQATHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHVAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PILFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXKIYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWPZEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNZFDJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPIJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVUDIHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCHXGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMABLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSFOKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPNDMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKNJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFPNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEMKS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe 2400 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe 1800 VOOKRP.exe 1800 VOOKRP.exe 1284 CCHXGJ.exe 1284 CCHXGJ.exe 4176 RXQK.exe 4176 RXQK.exe 3988 KAC.exe 3988 KAC.exe 2848 UYIAM.exe 2848 UYIAM.exe 2184 MTLE.exe 2184 MTLE.exe 3808 NWPZEI.exe 3808 NWPZEI.exe 3348 IJU.exe 3348 IJU.exe 2804 VUD.exe 2804 VUD.exe 6100 DHPOGRX.exe 6100 DHPOGRX.exe 5372 HKNJF.exe 5372 HKNJF.exe 4584 PQAQQ.exe 4584 PQAQQ.exe 4856 UVKF.exe 4856 UVKF.exe 108 DEMKS.exe 108 DEMKS.exe 3704 COXA.exe 3704 COXA.exe 3208 MMD.exe 3208 MMD.exe 3556 XFK.exe 3556 XFK.exe 3940 BNZFDJ.exe 3940 BNZFDJ.exe 5300 PICGJ.exe 5300 PICGJ.exe 3356 MIMJV.exe 3356 MIMJV.exe 1928 KTPZ.exe 1928 KTPZ.exe 6132 DWTUJFY.exe 6132 DWTUJFY.exe 4568 NUGPR.exe 4568 NUGPR.exe 5752 AFPNF.exe 5752 AFPNF.exe 5968 BATJKOD.exe 5968 BATJKOD.exe 3732 TDWN.exe 3732 TDWN.exe 4740 POND.exe 4740 POND.exe 4908 WEODLCP.exe 4908 WEODLCP.exe 1932 VPRT.exe 1932 VPRT.exe 2708 FMEN.exe 2708 FMEN.exe 3976 XPIJO.exe 3976 XPIJO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2400 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe 2400 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe 1800 VOOKRP.exe 1800 VOOKRP.exe 1284 CCHXGJ.exe 1284 CCHXGJ.exe 4176 RXQK.exe 4176 RXQK.exe 3988 KAC.exe 3988 KAC.exe 2848 UYIAM.exe 2848 UYIAM.exe 2184 MTLE.exe 2184 MTLE.exe 3808 NWPZEI.exe 3808 NWPZEI.exe 3348 IJU.exe 3348 IJU.exe 2804 VUD.exe 2804 VUD.exe 6100 DHPOGRX.exe 6100 DHPOGRX.exe 5372 HKNJF.exe 5372 HKNJF.exe 4584 PQAQQ.exe 4584 PQAQQ.exe 4856 UVKF.exe 4856 UVKF.exe 108 DEMKS.exe 108 DEMKS.exe 3704 COXA.exe 3704 COXA.exe 3208 MMD.exe 3208 MMD.exe 3556 XFK.exe 3556 XFK.exe 3940 BNZFDJ.exe 3940 BNZFDJ.exe 5300 PICGJ.exe 5300 PICGJ.exe 3356 MIMJV.exe 3356 MIMJV.exe 1928 KTPZ.exe 1928 KTPZ.exe 6132 DWTUJFY.exe 6132 DWTUJFY.exe 4568 NUGPR.exe 4568 NUGPR.exe 5752 AFPNF.exe 5752 AFPNF.exe 5968 BATJKOD.exe 5968 BATJKOD.exe 3732 TDWN.exe 3732 TDWN.exe 4740 POND.exe 4740 POND.exe 4908 WEODLCP.exe 4908 WEODLCP.exe 1932 VPRT.exe 1932 VPRT.exe 2708 FMEN.exe 2708 FMEN.exe 3976 XPIJO.exe 3976 XPIJO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 3840 2400 2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe 89 PID 3840 wrote to memory of 1800 3840 cmd.exe 93 PID 1800 wrote to memory of 2276 1800 VOOKRP.exe 95 PID 2276 wrote to memory of 1284 2276 cmd.exe 99 PID 1284 wrote to memory of 3188 1284 CCHXGJ.exe 100 PID 3188 wrote to memory of 4176 3188 cmd.exe 104 PID 4176 wrote to memory of 6004 4176 RXQK.exe 105 PID 6004 wrote to memory of 3988 6004 cmd.exe 109 PID 3988 wrote to memory of 5648 3988 KAC.exe 110 PID 5648 wrote to memory of 2848 5648 cmd.exe 114 PID 2848 wrote to memory of 5868 2848 UYIAM.exe 115 PID 5868 wrote to memory of 2184 5868 cmd.exe 119 PID 2184 wrote to memory of 5568 2184 MTLE.exe 120 PID 5568 wrote to memory of 3808 5568 cmd.exe 124 PID 3808 wrote to memory of 1784 3808 NWPZEI.exe 125 PID 1784 wrote to memory of 3348 1784 cmd.exe 129 PID 3348 wrote to memory of 2612 3348 IJU.exe 130 PID 2612 wrote to memory of 2804 2612 cmd.exe 134 PID 2804 wrote to memory of 2008 2804 VUD.exe 135 PID 2008 wrote to memory of 6100 2008 cmd.exe 139 PID 6100 wrote to memory of 3104 6100 DHPOGRX.exe 140 PID 3104 wrote to memory of 5372 3104 cmd.exe 144 PID 5372 wrote to memory of 5380 5372 HKNJF.exe 145 PID 5380 wrote to memory of 4584 5380 cmd.exe 149 PID 4584 wrote to memory of 3108 4584 PQAQQ.exe 150 PID 3108 wrote to memory of 4856 3108 cmd.exe 154 PID 4856 wrote to memory of 4296 4856 UVKF.exe 155 PID 4296 wrote to memory of 108 4296 cmd.exe 159 PID 108 wrote to memory of 4520 108 DEMKS.exe 160 PID 4520 wrote to memory of 3704 4520 cmd.exe 164 PID 3704 wrote to memory of 5532 3704 COXA.exe 165 PID 5532 wrote to memory of 3208 5532 cmd.exe 169 PID 3208 wrote to memory of 4756 3208 MMD.exe 170 PID 4756 wrote to memory of 3556 4756 cmd.exe 174 PID 3556 wrote to memory of 620 3556 XFK.exe 175 PID 620 wrote to memory of 3940 620 cmd.exe 179 PID 3940 wrote to memory of 5560 3940 BNZFDJ.exe 180 PID 5560 wrote to memory of 5300 5560 cmd.exe 184 PID 5300 wrote to memory of 4268 5300 PICGJ.exe 185 PID 4268 wrote to memory of 3356 4268 cmd.exe 189 PID 3356 wrote to memory of 4340 3356 MIMJV.exe 190 PID 4340 wrote to memory of 1928 4340 cmd.exe 194 PID 1928 wrote to memory of 4232 1928 KTPZ.exe 195 PID 4232 wrote to memory of 6132 4232 cmd.exe 199 PID 6132 wrote to memory of 3284 6132 DWTUJFY.exe 200 PID 3284 wrote to memory of 4568 3284 cmd.exe 204 PID 4568 wrote to memory of 4380 4568 NUGPR.exe 205 PID 4380 wrote to memory of 5752 4380 cmd.exe 209 PID 5752 wrote to memory of 268 5752 AFPNF.exe 210 PID 268 wrote to memory of 5968 268 cmd.exe 214 PID 5968 wrote to memory of 3660 5968 BATJKOD.exe 215 PID 3660 wrote to memory of 3732 3660 cmd.exe 219 PID 3732 wrote to memory of 2948 3732 TDWN.exe 220 PID 2948 wrote to memory of 4740 2948 cmd.exe 224 PID 4740 wrote to memory of 2908 4740 POND.exe 225 PID 2908 wrote to memory of 4908 2908 cmd.exe 229 PID 4908 wrote to memory of 5552 4908 WEODLCP.exe 230 PID 5552 wrote to memory of 1932 5552 cmd.exe 234 PID 1932 wrote to memory of 4848 1932 VPRT.exe 235 PID 4848 wrote to memory of 2708 4848 cmd.exe 239 PID 2708 wrote to memory of 1064 2708 FMEN.exe 240 PID 1064 wrote to memory of 3976 1064 cmd.exe 244 PID 3976 wrote to memory of 2428 3976 XPIJO.exe 245 PID 2428 wrote to memory of 3592 2428 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_bf643395e0ab18ceb12a1d8bcc9c02de_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOOKRP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\windows\system\VOOKRP.exeC:\windows\system\VOOKRP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCHXGJ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\SysWOW64\CCHXGJ.exeC:\windows\system32\CCHXGJ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXQK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\system\RXQK.exeC:\windows\system\RXQK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\system\KAC.exeC:\windows\system\KAC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UYIAM.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\UYIAM.exeC:\windows\UYIAM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MTLE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\system\MTLE.exeC:\windows\system\MTLE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJU.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\IJU.exeC:\windows\IJU.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\VUD.exeC:\windows\VUD.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DHPOGRX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\SysWOW64\DHPOGRX.exeC:\windows\system32\DHPOGRX.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\system\HKNJF.exeC:\windows\system\HKNJF.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVKF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\system\UVKF.exeC:\windows\system\UVKF.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEMKS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\DEMKS.exeC:\windows\DEMKS.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\SysWOW64\MMD.exeC:\windows\system32\MMD.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNZFDJ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\BNZFDJ.exeC:\windows\BNZFDJ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTPZ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\SysWOW64\KTPZ.exeC:\windows\system32\KTPZ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWTUJFY.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\system\DWTUJFY.exeC:\windows\system\DWTUJFY.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFPNF.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\system\AFPNF.exeC:\windows\system\AFPNF.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BATJKOD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\windows\BATJKOD.exeC:\windows\BATJKOD.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDWN.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\windows\system\TDWN.exeC:\windows\system\TDWN.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\windows\POND.exeC:\windows\POND.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEODLCP.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\SysWOW64\WEODLCP.exeC:\windows\system32\WEODLCP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\VPRT.exeC:\windows\VPRT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMEN.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\system\FMEN.exeC:\windows\system\FMEN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPIJO.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\XPIJO.exeC:\windows\XPIJO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe65⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4904 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1912 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4692 -
C:\windows\QGNH.exeC:\windows\QGNH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWOGG.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\windows\system\FWOGG.exeC:\windows\system\FWOGG.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCYWWG.exe.bat" "74⤵PID:5484
-
C:\windows\SysWOW64\CCYWWG.exeC:\windows\system32\CCYWWG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKABAMJ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1348 -
C:\windows\SysWOW64\TKABAMJ.exeC:\windows\system32\TKABAMJ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1908 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "80⤵PID:2812
-
C:\windows\LYP.exeC:\windows\LYP.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "82⤵PID:4624
-
C:\windows\HDZ.exeC:\windows\HDZ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "84⤵PID:1128
-
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPEX.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\windows\system\XPEX.exeC:\windows\system\XPEX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZUVFZV.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4936 -
C:\windows\KZUVFZV.exeC:\windows\KZUVFZV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4488 -
C:\windows\FNZ.exeC:\windows\FNZ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "94⤵PID:444
-
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IQMZ.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\system\IQMZ.exeC:\windows\system\IQMZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZNQWJT.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1628 -
C:\windows\QZNQWJT.exeC:\windows\QZNQWJT.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPCY.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1220 -
C:\windows\SysWOW64\CPCY.exeC:\windows\system32\CPCY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMHSPKP.exe.bat" "102⤵PID:1988
-
C:\windows\system\EMHSPKP.exeC:\windows\system\EMHSPKP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "104⤵PID:5332
-
C:\windows\system\CXKIYQ.exeC:\windows\system\CXKIYQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQATHQ.exe.bat" "106⤵PID:1216
-
C:\windows\system\WQATHQ.exeC:\windows\system\WQATHQ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYCYLOW.exe.bat" "108⤵PID:4800
-
C:\windows\SysWOW64\FYCYLOW.exeC:\windows\system32\FYCYLOW.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:724 -
C:\windows\SBY.exeC:\windows\SBY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "112⤵PID:4844
-
C:\windows\WREFCX.exeC:\windows\WREFCX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPS.exe.bat" "114⤵PID:3504
-
C:\windows\SysWOW64\GPS.exeC:\windows\system32\GPS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4704 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCZ.exe.bat" "118⤵PID:2796
-
C:\windows\SysWOW64\KCZ.exeC:\windows\system32\KCZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5056 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-