Analysis
- max time kernel
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe
- Size 208KB
- Sample260925-md4phstfmd
- SHA256 e8ed764c6d662ebd25ac1d7e362a2124a7712420c796c993d14a55ded3ba777a
- MD5 4d6614747343736f1ac50e9c280e1e47
- SHA1 ade82e7fb895ee2a8ea751b36b3db9dc55627a2a
- SHA512 d57f3032387e332c387a9d1046f0f74ea2e646ca7fae716504ee9c78d5c2c8b9e05d3f38143f8f97b2fe95f0b2c16f88514a0f001f60800d7e4ba1779c0e0952
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfa4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOCkEj1
- TLSH T166247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6036 MRC.exe 3716 XHQABD.exe 1940 LCOTQLC.exe 2476 XQVRV.exe 5744 JYB.exe 2728 SGDELD.exe 4720 YHL.exe 1376 CPSSGP.exe 3848 GFY.exe 6140 XFAF.exe 2508 SSFOYN.exe 1304 AGKVJL.exe 2696 JGMIUJP.exe 5408 KJPEAZ.exe 4728 IZJH.exe 4604 RHLMYJ.exe 3672 SKPHE.exe 424 NYTROZ.exe 4548 RGAZ.exe 5612 GWBQZNJ.exe 2940 VRK.exe 1080 DEX.exe 2808 DKPYE.exe 916 APHN.exe 6028 UDMWXG.exe 6000 MLOCIMC.exe 1804 GYTL.exe 2172 BMYUVL.exe 5900 HMX.exe 4464 HRYW.exe 1352 BNDGP.exe 4140 NFGZYAF.exe 5624 CAPL.exe 776 NTSWRC.exe 4484 ETMJUZG.exe 5856 QJN.exe 2612 JMRFVTW.exe 3416 ANT.exe 5964 MFODH.exe 5452 VSYVX.exe 200 VYYJYP.exe 2364 VBCFE.exe 6004 LWM.exe 5300 WPPC.exe 4992 NXDH.exe 1100 TSCIO.exe 5248 CXN.exe 3700 XTKKO.exe 4500 FYKYQ.exe 2868 UEQVX.exe 4788 GMWV.exe 1852 DMEJS.exe 5808 GZJSCZ.exe 2972 PILFG.exe 3296 TQRFSXP.exe 2608 LYT.exe 4248 UYVQZ.exe 3004 QETNOB.exe 5876 LRY.exe 1988 RSFKH.exe 5700 XSNXQX.exe 240 VNMG.exe 3744 KIWLGV.exe 1780 VBZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XQVRV.exe LCOTQLC.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat VSYVX.exe File opened for modification C:\windows\SysWOW64\RRHQES.exe QOEN.exe File created C:\windows\SysWOW64\WXURW.exe.bat CKP.exe File opened for modification C:\windows\SysWOW64\ALYYW.exe ULR.exe File created C:\windows\SysWOW64\SSFOYN.exe.bat XFAF.exe File opened for modification C:\windows\SysWOW64\JGMIUJP.exe AGKVJL.exe File opened for modification C:\windows\SysWOW64\ANT.exe JMRFVTW.exe File opened for modification C:\windows\SysWOW64\RKYR.exe WPT.exe File created C:\windows\SysWOW64\VUYEEKC.exe.bat GROA.exe File opened for modification C:\windows\SysWOW64\LCOTQLC.exe XHQABD.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe NTSWRC.exe File opened for modification C:\windows\SysWOW64\ULR.exe AXMTCA.exe File created C:\windows\SysWOW64\EYJCZL.exe VLZKRO.exe File created C:\windows\SysWOW64\XQVRV.exe.bat LCOTQLC.exe File opened for modification C:\windows\SysWOW64\HRYW.exe HMX.exe File created C:\windows\SysWOW64\HRYW.exe.bat HMX.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat SKPHE.exe File created C:\windows\SysWOW64\VNMG.exe.bat XSNXQX.exe File created C:\windows\SysWOW64\VBZ.exe KIWLGV.exe File created C:\windows\SysWOW64\EYJCZL.exe.bat VLZKRO.exe File created C:\windows\SysWOW64\WXURW.exe CKP.exe File opened for modification C:\windows\SysWOW64\WXURW.exe CKP.exe File opened for modification C:\windows\SysWOW64\XFAF.exe GFY.exe File created C:\windows\SysWOW64\SSFOYN.exe XFAF.exe File created C:\windows\SysWOW64\ETMJUZG.exe NTSWRC.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat NTSWRC.exe File opened for modification C:\windows\SysWOW64\QPKOZ.exe FWP.exe File created C:\windows\SysWOW64\QPKOZ.exe.bat FWP.exe File created C:\windows\SysWOW64\SVFFC.exe.bat XIA.exe File created C:\windows\SysWOW64\XFAF.exe GFY.exe File created C:\windows\SysWOW64\JGMIUJP.exe AGKVJL.exe File created C:\windows\SysWOW64\ANT.exe.bat JMRFVTW.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat LYT.exe File created C:\windows\SysWOW64\VNMG.exe XSNXQX.exe File created C:\windows\SysWOW64\ALYYW.exe.bat ULR.exe File created C:\windows\SysWOW64\LDVPBYM.exe NIEHWV.exe File created C:\windows\SysWOW64\QHW.exe.bat AMFIVY.exe File opened for modification C:\windows\SysWOW64\EYJCZL.exe VLZKRO.exe File opened for modification C:\windows\SysWOW64\QHW.exe AMFIVY.exe File created C:\windows\SysWOW64\SVFFC.exe XIA.exe File created C:\windows\SysWOW64\VYDHGBO.exe ALYYW.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe VSYVX.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe PILFG.exe File created C:\windows\SysWOW64\UYVQZ.exe LYT.exe File created C:\windows\SysWOW64\VBZ.exe.bat KIWLGV.exe File created C:\windows\SysWOW64\QPKOZ.exe FWP.exe File created C:\windows\SysWOW64\VYDHGBO.exe.bat ALYYW.exe File created C:\windows\SysWOW64\VUYEEKC.exe GROA.exe File created C:\windows\SysWOW64\LCOTQLC.exe XHQABD.exe File created C:\windows\SysWOW64\XFAF.exe.bat GFY.exe File created C:\windows\SysWOW64\NYTROZ.exe SKPHE.exe File created C:\windows\SysWOW64\ANT.exe JMRFVTW.exe File created C:\windows\SysWOW64\TQRFSXP.exe.bat PILFG.exe File opened for modification C:\windows\SysWOW64\VBZ.exe KIWLGV.exe File created C:\windows\SysWOW64\ALYYW.exe ULR.exe File created C:\windows\SysWOW64\RKYR.exe.bat WPT.exe File created C:\windows\SysWOW64\KSE.exe VUYEEKC.exe File opened for modification C:\windows\SysWOW64\KSE.exe VUYEEKC.exe File created C:\windows\SysWOW64\KSE.exe.bat VUYEEKC.exe File opened for modification C:\windows\SysWOW64\SVFFC.exe XIA.exe File created C:\windows\SysWOW64\LCOTQLC.exe.bat XHQABD.exe File created C:\windows\SysWOW64\XQVRV.exe LCOTQLC.exe File opened for modification C:\windows\SysWOW64\SSFOYN.exe XFAF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\APHN.exe.bat DKPYE.exe File created C:\windows\CPSSGP.exe YHL.exe File opened for modification C:\windows\CPSSGP.exe YHL.exe File opened for modification C:\windows\system\VBCFE.exe VYYJYP.exe File created C:\windows\system\CXN.exe TSCIO.exe File created C:\windows\system\AXMTCA.exe QPKOZ.exe File created C:\windows\system\CKP.exe RRMPMEJ.exe File created C:\windows\CAPL.exe.bat NFGZYAF.exe File created C:\windows\system\GROA.exe.bat MEKQJYE.exe File created C:\windows\system\CXN.exe.bat TSCIO.exe File created C:\windows\DMEJS.exe GMWV.exe File opened for modification C:\windows\system\AXMTCA.exe QPKOZ.exe File created C:\windows\system\XGGNBWB.exe.bat DLBEZW.exe File created C:\windows\system\QOI.exe NBRJNVS.exe File created C:\windows\NXDH.exe.bat WPPC.exe File created C:\windows\FYKYQ.exe XTKKO.exe File created C:\windows\system\BZRFO.exe.bat QHW.exe File created C:\windows\VSYVX.exe MFODH.exe File opened for modification C:\windows\WPPC.exe LWM.exe File created C:\windows\system\SKPHE.exe.bat RHLMYJ.exe File created C:\windows\NFGZYAF.exe BNDGP.exe File created C:\windows\system\LYT.exe.bat TQRFSXP.exe File created C:\windows\OKADEWJ.exe RFUOX.exe File created C:\windows\XHQABD.exe.bat MRC.exe File created C:\windows\RGAZ.exe.bat NYTROZ.exe File created C:\windows\system\RFUOX.exe.bat UHOR.exe File opened for modification C:\windows\system\BZRFO.exe QHW.exe File opened for modification C:\windows\YHL.exe SGDELD.exe File created C:\windows\TSCIO.exe.bat NXDH.exe File created C:\windows\system\XGGNBWB.exe DLBEZW.exe File opened for modification C:\windows\VSYVX.exe MFODH.exe File created C:\windows\QOEN.exe.bat VBZ.exe File created C:\windows\system\DKPYE.exe.bat DEX.exe File opened for modification C:\windows\system\DEX.exe VRK.exe File created C:\windows\UDMWXG.exe APHN.exe File created C:\windows\BMYUVL.exe.bat GYTL.exe File opened for modification C:\windows\AMFIVY.exe AYNUM.exe File opened for modification C:\windows\system\GFY.exe CPSSGP.exe File opened for modification C:\windows\system\PTI.exe VYDHGBO.exe File created C:\windows\system\VLZKRO.exe DLXF.exe File opened for modification C:\windows\AGKVJL.exe SSFOYN.exe File opened for modification C:\windows\LWM.exe VBCFE.exe File opened for modification C:\windows\NIEHWV.exe RKYR.exe File opened for modification C:\windows\system\KJPEAZ.exe JGMIUJP.exe File opened for modification C:\windows\MLOCIMC.exe UDMWXG.exe File created C:\windows\system\JMRFVTW.exe QJN.exe File created C:\windows\system\VLZKRO.exe.bat DLXF.exe File created C:\windows\system\RRMPMEJ.exe QOI.exe File created C:\windows\HMX.exe BMYUVL.exe File created C:\windows\XTKKO.exe.bat CXN.exe File created C:\windows\system\UEQVX.exe FYKYQ.exe File created C:\windows\XTKKO.exe CXN.exe File created C:\windows\system\VBCFE.exe VYYJYP.exe File opened for modification C:\windows\PILFG.exe GZJSCZ.exe File opened for modification C:\windows\MSUYPH.exe BZRFO.exe File created C:\windows\XIA.exe VKHUT.exe File opened for modification C:\windows\system\OQXPOV.exe RTZAGMU.exe File created C:\windows\AGKVJL.exe.bat SSFOYN.exe File created C:\windows\RGAZ.exe NYTROZ.exe File opened for modification C:\windows\UDMWXG.exe APHN.exe File opened for modification C:\windows\system\LYT.exe TQRFSXP.exe File created C:\windows\QETNOB.exe UYVQZ.exe File opened for modification C:\windows\WPT.exe KHNAA.exe File created C:\windows\system\OQXPOV.exe.bat RTZAGMU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5008 cmd.exe 2388 cmd.exe 2552 cmd.exe 4116 cmd.exe 2576 cmd.exe 5568 cmd.exe 2288 cmd.exe 5776 cmd.exe 2680 cmd.exe 4676 cmd.exe 4692 cmd.exe 5232 cmd.exe 1688 cmd.exe 2300 cmd.exe 1648 cmd.exe 1844 cmd.exe 1240 cmd.exe 5284 cmd.exe 2840 cmd.exe 3532 cmd.exe 3512 cmd.exe 744 cmd.exe 1588 cmd.exe 4960 cmd.exe 3372 cmd.exe 4568 cmd.exe 1160 cmd.exe 1368 cmd.exe 5084 cmd.exe 6128 cmd.exe 3444 cmd.exe 2448 cmd.exe 5768 cmd.exe 5228 cmd.exe 3772 cmd.exe 1776 cmd.exe 3472 cmd.exe 5312 cmd.exe 2556 cmd.exe 5936 cmd.exe 3436 cmd.exe 2960 cmd.exe 756 cmd.exe 1328 cmd.exe 2124 cmd.exe 1896 cmd.exe 3260 cmd.exe 700 cmd.exe 3784 cmd.exe 5952 cmd.exe 2988 cmd.exe 5520 cmd.exe 4372 cmd.exe 5604 cmd.exe 5648 cmd.exe 4684 cmd.exe 1980 cmd.exe 2148 cmd.exe 4208 cmd.exe 1256 cmd.exe 2852 cmd.exe 1300 cmd.exe 2560 cmd.exe 3224 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 776 5060 WerFault.exe 87 4816 6036 WerFault.exe 93 4600 3716 WerFault.exe 99 1712 1940 WerFault.exe 104 544 2476 WerFault.exe 109 5636 5744 WerFault.exe 114 3756 2728 WerFault.exe 119 3568 4720 WerFault.exe 124 5192 1376 WerFault.exe 129 1368 3848 WerFault.exe 134 1752 6140 WerFault.exe 139 5816 2508 WerFault.exe 144 3740 1304 WerFault.exe 149 3024 2696 WerFault.exe 154 1480 5408 WerFault.exe 159 3004 4728 WerFault.exe 164 5360 4604 WerFault.exe 169 6136 3672 WerFault.exe 174 3544 424 WerFault.exe 179 5076 4548 WerFault.exe 184 5228 5612 WerFault.exe 189 3212 2940 WerFault.exe 194 3088 1080 WerFault.exe 199 3760 2808 WerFault.exe 204 3484 916 WerFault.exe 209 524 6028 WerFault.exe 214 5196 6000 WerFault.exe 219 2088 1804 WerFault.exe 224 416 2172 WerFault.exe 229 2868 5900 WerFault.exe 234 3788 4464 WerFault.exe 239 5228 1352 WerFault.exe 244 3212 4140 WerFault.exe 249 2836 5624 WerFault.exe 254 4992 776 WerFault.exe 259 3252 4484 WerFault.exe 264 4652 5856 WerFault.exe 269 2632 2612 WerFault.exe 274 1800 3416 WerFault.exe 279 2684 5964 WerFault.exe 284 3428 5452 WerFault.exe 289 1412 200 WerFault.exe 294 2352 2364 WerFault.exe 299 4708 6004 WerFault.exe 304 3980 5300 WerFault.exe 309 2608 4992 WerFault.exe 314 1812 1100 WerFault.exe 319 1628 5248 WerFault.exe 324 2620 3700 WerFault.exe 329 5580 4500 WerFault.exe 334 2092 2868 WerFault.exe 339 2900 4788 WerFault.exe 344 5284 1852 WerFault.exe 349 3088 5808 WerFault.exe 354 4468 2972 WerFault.exe 359 4732 3296 WerFault.exe 364 5496 2608 WerFault.exe 369 5088 4248 WerFault.exe 374 5652 3004 WerFault.exe 379 2472 5876 WerFault.exe 384 4176 1988 WerFault.exe 389 5268 5700 WerFault.exe 394 3552 240 WerFault.exe 399 3980 3744 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIWLGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYDHGBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUYPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBCFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMEJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKADEWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQVRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPSSGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GROA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHQABD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMYUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETMJUZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSNXQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMFIVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGDELD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKPYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXURW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QETNOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLBEZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJPEAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTKKO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5060 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe 5060 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe 6036 MRC.exe 6036 MRC.exe 3716 XHQABD.exe 3716 XHQABD.exe 1940 LCOTQLC.exe 1940 LCOTQLC.exe 2476 XQVRV.exe 2476 XQVRV.exe 5744 JYB.exe 5744 JYB.exe 2728 SGDELD.exe 2728 SGDELD.exe 4720 YHL.exe 4720 YHL.exe 1376 CPSSGP.exe 1376 CPSSGP.exe 3848 GFY.exe 3848 GFY.exe 6140 XFAF.exe 6140 XFAF.exe 2508 SSFOYN.exe 2508 SSFOYN.exe 1304 AGKVJL.exe 1304 AGKVJL.exe 2696 JGMIUJP.exe 2696 JGMIUJP.exe 5408 KJPEAZ.exe 5408 KJPEAZ.exe 4728 IZJH.exe 4728 IZJH.exe 4604 RHLMYJ.exe 4604 RHLMYJ.exe 3672 SKPHE.exe 3672 SKPHE.exe 424 NYTROZ.exe 424 NYTROZ.exe 4548 RGAZ.exe 4548 RGAZ.exe 5612 GWBQZNJ.exe 5612 GWBQZNJ.exe 2940 VRK.exe 2940 VRK.exe 1080 DEX.exe 1080 DEX.exe 2808 DKPYE.exe 2808 DKPYE.exe 916 APHN.exe 916 APHN.exe 6028 UDMWXG.exe 6028 UDMWXG.exe 6000 MLOCIMC.exe 6000 MLOCIMC.exe 1804 GYTL.exe 1804 GYTL.exe 2172 BMYUVL.exe 2172 BMYUVL.exe 5900 HMX.exe 5900 HMX.exe 4464 HRYW.exe 4464 HRYW.exe 1352 BNDGP.exe 1352 BNDGP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5060 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe 5060 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe 6036 MRC.exe 6036 MRC.exe 3716 XHQABD.exe 3716 XHQABD.exe 1940 LCOTQLC.exe 1940 LCOTQLC.exe 2476 XQVRV.exe 2476 XQVRV.exe 5744 JYB.exe 5744 JYB.exe 2728 SGDELD.exe 2728 SGDELD.exe 4720 YHL.exe 4720 YHL.exe 1376 CPSSGP.exe 1376 CPSSGP.exe 3848 GFY.exe 3848 GFY.exe 6140 XFAF.exe 6140 XFAF.exe 2508 SSFOYN.exe 2508 SSFOYN.exe 1304 AGKVJL.exe 1304 AGKVJL.exe 2696 JGMIUJP.exe 2696 JGMIUJP.exe 5408 KJPEAZ.exe 5408 KJPEAZ.exe 4728 IZJH.exe 4728 IZJH.exe 4604 RHLMYJ.exe 4604 RHLMYJ.exe 3672 SKPHE.exe 3672 SKPHE.exe 424 NYTROZ.exe 424 NYTROZ.exe 4548 RGAZ.exe 4548 RGAZ.exe 5612 GWBQZNJ.exe 5612 GWBQZNJ.exe 2940 VRK.exe 2940 VRK.exe 1080 DEX.exe 1080 DEX.exe 2808 DKPYE.exe 2808 DKPYE.exe 916 APHN.exe 916 APHN.exe 6028 UDMWXG.exe 6028 UDMWXG.exe 6000 MLOCIMC.exe 6000 MLOCIMC.exe 1804 GYTL.exe 1804 GYTL.exe 2172 BMYUVL.exe 2172 BMYUVL.exe 5900 HMX.exe 5900 HMX.exe 4464 HRYW.exe 4464 HRYW.exe 1352 BNDGP.exe 1352 BNDGP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 2148 5060 2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe 89 PID 2148 wrote to memory of 6036 2148 cmd.exe 93 PID 6036 wrote to memory of 4572 6036 MRC.exe 95 PID 4572 wrote to memory of 3716 4572 cmd.exe 99 PID 3716 wrote to memory of 1680 3716 XHQABD.exe 100 PID 1680 wrote to memory of 1940 1680 cmd.exe 104 PID 1940 wrote to memory of 4960 1940 LCOTQLC.exe 105 PID 4960 wrote to memory of 2476 4960 cmd.exe 109 PID 2476 wrote to memory of 2288 2476 XQVRV.exe 110 PID 2288 wrote to memory of 5744 2288 cmd.exe 114 PID 5744 wrote to memory of 2852 5744 JYB.exe 115 PID 2852 wrote to memory of 2728 2852 cmd.exe 119 PID 2728 wrote to memory of 2732 2728 SGDELD.exe 120 PID 2732 wrote to memory of 4720 2732 cmd.exe 124 PID 4720 wrote to memory of 1832 4720 YHL.exe 125 PID 1832 wrote to memory of 1376 1832 cmd.exe 129 PID 1376 wrote to memory of 4344 1376 CPSSGP.exe 130 PID 4344 wrote to memory of 3848 4344 cmd.exe 134 PID 3848 wrote to memory of 5952 3848 GFY.exe 135 PID 5952 wrote to memory of 6140 5952 cmd.exe 139 PID 6140 wrote to memory of 1896 6140 XFAF.exe 140 PID 1896 wrote to memory of 2508 1896 cmd.exe 144 PID 2508 wrote to memory of 5364 2508 SSFOYN.exe 145 PID 5364 wrote to memory of 1304 5364 cmd.exe 149 PID 1304 wrote to memory of 3032 1304 AGKVJL.exe 150 PID 3032 wrote to memory of 2696 3032 cmd.exe 154 PID 2696 wrote to memory of 2988 2696 JGMIUJP.exe 155 PID 2988 wrote to memory of 5408 2988 cmd.exe 159 PID 5408 wrote to memory of 2448 5408 KJPEAZ.exe 160 PID 2448 wrote to memory of 4728 2448 cmd.exe 164 PID 4728 wrote to memory of 1300 4728 IZJH.exe 165 PID 1300 wrote to memory of 4604 1300 cmd.exe 169 PID 4604 wrote to memory of 5820 4604 RHLMYJ.exe 170 PID 5820 wrote to memory of 3672 5820 cmd.exe 174 PID 3672 wrote to memory of 3372 3672 SKPHE.exe 175 PID 3372 wrote to memory of 424 3372 cmd.exe 179 PID 424 wrote to memory of 3436 424 NYTROZ.exe 180 PID 3436 wrote to memory of 4548 3436 cmd.exe 184 PID 4548 wrote to memory of 2960 4548 RGAZ.exe 185 PID 2960 wrote to memory of 5612 2960 cmd.exe 189 PID 5612 wrote to memory of 2560 5612 GWBQZNJ.exe 190 PID 2560 wrote to memory of 2940 2560 cmd.exe 194 PID 2940 wrote to memory of 5468 2940 VRK.exe 195 PID 5468 wrote to memory of 1080 5468 cmd.exe 199 PID 1080 wrote to memory of 5416 1080 DEX.exe 200 PID 5416 wrote to memory of 2808 5416 cmd.exe 204 PID 2808 wrote to memory of 5520 2808 DKPYE.exe 205 PID 5520 wrote to memory of 916 5520 cmd.exe 209 PID 916 wrote to memory of 2136 916 APHN.exe 210 PID 2136 wrote to memory of 6028 2136 cmd.exe 214 PID 6028 wrote to memory of 5656 6028 UDMWXG.exe 215 PID 5656 wrote to memory of 6000 5656 cmd.exe 219 PID 6000 wrote to memory of 4208 6000 MLOCIMC.exe 220 PID 4208 wrote to memory of 1804 4208 cmd.exe 224 PID 1804 wrote to memory of 4712 1804 GYTL.exe 225 PID 4712 wrote to memory of 2172 4712 cmd.exe 229 PID 2172 wrote to memory of 5380 2172 BMYUVL.exe 230 PID 5380 wrote to memory of 5900 5380 cmd.exe 234 PID 5900 wrote to memory of 5232 5900 HMX.exe 235 PID 5232 wrote to memory of 4464 5232 cmd.exe 239 PID 4464 wrote to memory of 2384 4464 HRYW.exe 240 PID 2384 wrote to memory of 1352 2384 cmd.exe 244 PID 1352 wrote to memory of 2444 1352 BNDGP.exe 245 PID 2444 wrote to memory of 4140 2444 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_4d6614747343736f1ac50e9c280e1e47_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCOTQLC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\SysWOW64\LCOTQLC.exeC:\windows\system32\LCOTQLC.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\JYB.exeC:\windows\JYB.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGDELD.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\system\SGDELD.exeC:\windows\system\SGDELD.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\YHL.exeC:\windows\YHL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFY.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\GFY.exeC:\windows\system\GFY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSFOYN.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\SysWOW64\SSFOYN.exeC:\windows\system32\SSFOYN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZJH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\system\IZJH.exeC:\windows\system\IZJH.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKPHE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\system\SKPHE.exeC:\windows\system\SKPHE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\RGAZ.exeC:\windows\RGAZ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRK.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\system\VRK.exeC:\windows\system\VRK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DEX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\system\DEX.exeC:\windows\system\DEX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\APHN.exeC:\windows\APHN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDMWXG.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\windows\UDMWXG.exeC:\windows\UDMWXG.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\windows\GYTL.exeC:\windows\GYTL.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\HMX.exeC:\windows\HMX.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1688 -
C:\windows\CAPL.exeC:\windows\CAPL.exe67⤵
- Executes dropped EXE
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NTSWRC.exe.bat" "68⤵PID:5600
-
C:\windows\system\NTSWRC.exeC:\windows\system\NTSWRC.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "70⤵PID:4364
-
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "72⤵
- Executes a command shell one-liner
PID:756 -
C:\windows\system\QJN.exeC:\windows\system\QJN.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMRFVTW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\windows\system\JMRFVTW.exeC:\windows\system\JMRFVTW.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANT.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1328 -
C:\windows\SysWOW64\ANT.exeC:\windows\system32\ANT.exe77⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "78⤵PID:876
-
C:\windows\MFODH.exeC:\windows\MFODH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "80⤵PID:4688
-
C:\windows\VSYVX.exeC:\windows\VSYVX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5736 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5768 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "86⤵PID:4336
-
C:\windows\LWM.exeC:\windows\LWM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPPC.exe.bat" "88⤵PID:1156
-
C:\windows\WPPC.exeC:\windows\WPPC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "90⤵PID:8
-
C:\windows\NXDH.exeC:\windows\NXDH.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSCIO.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\windows\TSCIO.exeC:\windows\TSCIO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\windows\system\CXN.exeC:\windows\system\CXN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTKKO.exe.bat" "96⤵PID:5212
-
C:\windows\XTKKO.exeC:\windows\XTKKO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYKYQ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5008 -
C:\windows\FYKYQ.exeC:\windows\FYKYQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEQVX.exe.bat" "100⤵PID:2100
-
C:\windows\system\UEQVX.exeC:\windows\system\UEQVX.exe101⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMWV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4372 -
C:\windows\system\GMWV.exeC:\windows\system\GMWV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMEJS.exe.bat" "104⤵PID:6056
-
C:\windows\DMEJS.exeC:\windows\DMEJS.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJSCZ.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:6008 -
C:\windows\GZJSCZ.exeC:\windows\GZJSCZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PILFG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2388 -
C:\windows\PILFG.exeC:\windows\PILFG.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQRFSXP.exe.bat" "110⤵PID:1864
-
C:\windows\SysWOW64\TQRFSXP.exeC:\windows\system32\TQRFSXP.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYT.exe.bat" "112⤵PID:3276
-
C:\windows\system\LYT.exeC:\windows\system\LYT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "114⤵PID:2788
-
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\QETNOB.exeC:\windows\QETNOB.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5604 -
C:\windows\system\LRY.exeC:\windows\system\LRY.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSFKH.exe.bat" "120⤵PID:3404
-
C:\windows\system\RSFKH.exeC:\windows\system\RSFKH.exe121⤵
- Executes dropped EXE
PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-