Analysis
- max time kernel
83s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe
- Size 208KB
- Sample261002-26nw4aaa34
- SHA256 b517e68569f836c7de6c89e0b6c1f637d542c36af1eb566b9cca9ae5ee0a70a7
- MD5 eca4f2a1f8c95475ec50449ed4713a49
- SHA1 bc6edd7fa6a38d7e14bbe0d3d141793ab3777e58
- SHA512 7f2d24483fdfa354cefaa854a50e1c87ea93e5ad25c18f269fd89365f0f6a819a90ca547d819273a2cbfd50c614e06a172602cc927412533cb1b86d644867726
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfe4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOmkEj1
- TLSH T167247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4396 URCS.exe 1552 WFNQ.exe 1204 NIGTON.exe 5880 IVLKQ.exe 5956 KJCM.exe 1412 LMGIPWP.exe 3408 JHX.exe 4640 CAM.exe 2304 XNRLN.exe 3256 WYUB.exe 5596 OBYWBW.exe 5776 AJMEO.exe 6064 VEROYOC.exe 1256 ZMYOK.exe 3336 JKDIRHH.exe 4820 JPE.exe 5448 DLIGD.exe 4788 CAUJQ.exe 3388 IWTKVC.exe 5384 MEZ.exe 5368 QUGSTE.exe 4148 ASUMB.exe 4776 CPZZI.exe 6004 KVMF.exe 1572 EIJXDB.exe 1520 JJTZH.exe 3468 EWXIRXX.exe 4372 XPFTJYF.exe 3372 GXH.exe 5668 QXJDQ.exe 5948 UDBTG.exe 1304 ELDGJC.exe 3464 HTKG.exe 404 KOOPGM.exe 4252 FCTZQMG.exe 5716 OCVE.exe 2368 XKXRXOK.exe 2924 OQI.exe 4480 EGJATH.exe 4884 PYETUOC.exe 2652 EBNXN.exe 3120 OCPKQGN.exe 4332 IPU.exe 4268 DKZDD.exe 5400 SFI.exe 2000 DYLA.exe 5824 PQOTE.exe 3980 GRQYINY.exe 3692 BMV.exe 2344 ZCGLNSV.exe 2176 ZHG.exe 3668 UDLJ.exe 1064 JYVNKRN.exe 3872 AYXS.exe 6008 VLCBX.exe 4040 EUWO.exe 2724 TPNTM.exe 2636 HUNEW.exe 1488 HPRABIA.exe 5876 LFXI.exe 4536 AAHNYVW.exe 4156 TDTQML.exe 6116 ZRKRJON.exe 3508 HEWYTNJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\UPTUUGH.exe ZNLDGEM.exe File created C:\windows\SysWOW64\QOSJASU.exe.bat PTPNU.exe File opened for modification C:\windows\SysWOW64\DRWJD.exe VLSCSS.exe File created C:\windows\SysWOW64\QSZW.exe WXUMXCA.exe File created C:\windows\SysWOW64\XNRLN.exe CAM.exe File created C:\windows\SysWOW64\GXH.exe.bat XPFTJYF.exe File created C:\windows\SysWOW64\AAHNYVW.exe LFXI.exe File created C:\windows\SysWOW64\DRWJD.exe.bat VLSCSS.exe File created C:\windows\SysWOW64\QVUIH.exe.bat DXUWFYB.exe File created C:\windows\SysWOW64\JPE.exe JKDIRHH.exe File opened for modification C:\windows\SysWOW64\JPE.exe JKDIRHH.exe File created C:\windows\SysWOW64\OQI.exe.bat XKXRXOK.exe File opened for modification C:\windows\SysWOW64\CMLZWD.exe ZZGQT.exe File created C:\windows\SysWOW64\CMLZWD.exe.bat ZZGQT.exe File created C:\windows\SysWOW64\VLSCSS.exe MDQ.exe File created C:\windows\SysWOW64\XNRLN.exe.bat CAM.exe File opened for modification C:\windows\SysWOW64\WYUB.exe XNRLN.exe File created C:\windows\SysWOW64\WZQ.exe CMLZWD.exe File created C:\windows\SysWOW64\CFKDZ.exe HSF.exe File opened for modification C:\windows\SysWOW64\OQI.exe XKXRXOK.exe File created C:\windows\SysWOW64\CMLZWD.exe ZZGQT.exe File created C:\windows\SysWOW64\CLAQ.exe QVUIH.exe File created C:\windows\SysWOW64\CFKDZ.exe.bat HSF.exe File created C:\windows\SysWOW64\AJMEO.exe OBYWBW.exe File opened for modification C:\windows\SysWOW64\AJMEO.exe OBYWBW.exe File created C:\windows\SysWOW64\JPE.exe.bat JKDIRHH.exe File created C:\windows\SysWOW64\EGJATH.exe.bat OQI.exe File created C:\windows\SysWOW64\HUNEW.exe.bat TPNTM.exe File opened for modification C:\windows\SysWOW64\CLAQ.exe QVUIH.exe File created C:\windows\SysWOW64\OKKL.exe UXFBEHO.exe File created C:\windows\SysWOW64\WZQ.exe.bat CMLZWD.exe File opened for modification C:\windows\SysWOW64\CFKDZ.exe HSF.exe File created C:\windows\SysWOW64\ASUMB.exe QUGSTE.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat GXH.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe KOOPGM.exe File opened for modification C:\windows\SysWOW64\PQOTE.exe DYLA.exe File opened for modification C:\windows\SysWOW64\UXFBEHO.exe MRBVTIS.exe File created C:\windows\SysWOW64\TPNTM.exe EUWO.exe File created C:\windows\SysWOW64\WYUB.exe.bat XNRLN.exe File created C:\windows\SysWOW64\GXH.exe XPFTJYF.exe File opened for modification C:\windows\SysWOW64\AAHNYVW.exe LFXI.exe File created C:\windows\SysWOW64\UPTUUGH.exe.bat ZNLDGEM.exe File created C:\windows\SysWOW64\MVE.exe.bat ADOOF.exe File created C:\windows\SysWOW64\PTPNU.exe.bat LDI.exe File created C:\windows\SysWOW64\KJCM.exe IVLKQ.exe File created C:\windows\SysWOW64\ASUMB.exe.bat QUGSTE.exe File opened for modification C:\windows\SysWOW64\LFXI.exe HPRABIA.exe File opened for modification C:\windows\SysWOW64\LDI.exe BFU.exe File created C:\windows\SysWOW64\OKKL.exe.bat UXFBEHO.exe File created C:\windows\SysWOW64\TPNTM.exe.bat EUWO.exe File created C:\windows\SysWOW64\AAHNYVW.exe.bat LFXI.exe File created C:\windows\SysWOW64\PTPNU.exe LDI.exe File created C:\windows\SysWOW64\QOSJASU.exe PTPNU.exe File opened for modification C:\windows\SysWOW64\QOSJASU.exe PTPNU.exe File opened for modification C:\windows\SysWOW64\MDQ.exe CFKDZ.exe File created C:\windows\SysWOW64\QVUIH.exe DXUWFYB.exe File created C:\windows\SysWOW64\XKXRXOK.exe OCVE.exe File opened for modification C:\windows\SysWOW64\MRBVTIS.exe KUN.exe File created C:\windows\SysWOW64\MDQ.exe CFKDZ.exe File created C:\windows\SysWOW64\KJCM.exe.bat IVLKQ.exe File created C:\windows\SysWOW64\MVE.exe ADOOF.exe File created C:\windows\SysWOW64\UXFBEHO.exe MRBVTIS.exe File opened for modification C:\windows\SysWOW64\QSZW.exe WXUMXCA.exe File created C:\windows\SysWOW64\LFXI.exe.bat HPRABIA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\IVLKQ.exe NIGTON.exe File opened for modification C:\windows\CAM.exe JHX.exe File created C:\windows\system\KOOPGM.exe HTKG.exe File opened for modification C:\windows\system\DYLA.exe SFI.exe File opened for modification C:\windows\KUQAS.exe VZYOGOR.exe File created C:\windows\PBJ.exe PORGHFU.exe File opened for modification C:\windows\system\QZFT.exe FGCAZRQ.exe File created C:\windows\system\QZFT.exe.bat FGCAZRQ.exe File opened for modification C:\windows\ZMYOK.exe VEROYOC.exe File created C:\windows\system\EWXIRXX.exe.bat JJTZH.exe File created C:\windows\ELDGJC.exe UDBTG.exe File opened for modification C:\windows\system\JYVNKRN.exe UDLJ.exe File created C:\windows\BFU.exe UPTUUGH.exe File opened for modification C:\windows\system\KOOPGM.exe HTKG.exe File created C:\windows\system\BMV.exe.bat GRQYINY.exe File created C:\windows\system\UDLJ.exe.bat ZHG.exe File created C:\windows\IGOHWGM.exe.bat CKPH.exe File created C:\windows\system\JKDIRHH.exe.bat ZMYOK.exe File created C:\windows\system\EIJXDB.exe KVMF.exe File created C:\windows\system\HTKG.exe ELDGJC.exe File created C:\windows\HPRABIA.exe HUNEW.exe File created C:\windows\HPRABIA.exe.bat HUNEW.exe File created C:\windows\BLFYVM.exe.bat MVE.exe File created C:\windows\system\UDLJ.exe ZHG.exe File created C:\windows\KVMF.exe.bat CPZZI.exe File created C:\windows\system\QUGSTE.exe.bat MEZ.exe File opened for modification C:\windows\system\PORGHFU.exe CLAQ.exe File opened for modification C:\windows\system\KPOET.exe PBJ.exe File created C:\windows\system\CPZZI.exe ASUMB.exe File created C:\windows\system\ZZGQT.exe IGDALY.exe File created C:\windows\system\VZYOGOR.exe DRWJD.exe File opened for modification C:\windows\DXUWFYB.exe KUQAS.exe File created C:\windows\system\NIGTON.exe WFNQ.exe File created C:\windows\system\MEZ.exe IWTKVC.exe File created C:\windows\system\MEZ.exe.bat IWTKVC.exe File opened for modification C:\windows\system\EIJXDB.exe KVMF.exe File created C:\windows\ELDGJC.exe.bat UDBTG.exe File created C:\windows\system\KUN.exe.bat CGJ.exe File created C:\windows\KUQAS.exe.bat VZYOGOR.exe File created C:\windows\system\OBYWBW.exe.bat WYUB.exe File created C:\windows\ZMYOK.exe.bat VEROYOC.exe File created C:\windows\XPFTJYF.exe EWXIRXX.exe File created C:\windows\BFU.exe.bat UPTUUGH.exe File created C:\windows\ADOOF.exe.bat HCZDO.exe File created C:\windows\system\KVBKCSY.exe.bat OKKL.exe File opened for modification C:\windows\IVLKQ.exe NIGTON.exe File opened for modification C:\windows\system\QUGSTE.exe MEZ.exe File created C:\windows\system\BMV.exe GRQYINY.exe File created C:\windows\system\KUN.exe CGJ.exe File opened for modification C:\windows\system\KUN.exe CGJ.exe File created C:\windows\system\FGCAZRQ.exe.bat VIWGK.exe File created C:\windows\system\OBYWBW.exe WYUB.exe File created C:\windows\system\HTKG.exe.bat ELDGJC.exe File created C:\windows\TDTQML.exe.bat AAHNYVW.exe File created C:\windows\HEWYTNJ.exe.bat ZRKRJON.exe File created C:\windows\ZNLDGEM.exe.bat HEWYTNJ.exe File created C:\windows\HCZDO.exe.bat ZXUWD.exe File opened for modification C:\windows\system\HTKG.exe ELDGJC.exe File opened for modification C:\windows\system\BMV.exe GRQYINY.exe File created C:\windows\system\ZHG.exe ZCGLNSV.exe File opened for modification C:\windows\system\UDLJ.exe ZHG.exe File created C:\windows\system\ZRKRJON.exe TDTQML.exe File opened for modification C:\windows\system\ZXUWD.exe QOSJASU.exe File created C:\windows\HCZDO.exe ZXUWD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2488 cmd.exe 2032 cmd.exe 2700 cmd.exe 5528 cmd.exe 5772 cmd.exe 4384 cmd.exe 1180 cmd.exe 3908 cmd.exe 5112 cmd.exe 5184 cmd.exe 5364 cmd.exe 5932 cmd.exe 5312 cmd.exe 1300 cmd.exe 4976 cmd.exe 5016 cmd.exe 3564 cmd.exe 4164 cmd.exe 2796 cmd.exe 4628 cmd.exe 4284 cmd.exe 3296 cmd.exe 3068 cmd.exe 2500 cmd.exe 3376 cmd.exe 568 cmd.exe 2584 cmd.exe 3520 cmd.exe 1500 cmd.exe 4824 cmd.exe 4032 cmd.exe 3164 cmd.exe 4368 cmd.exe 3332 cmd.exe 952 cmd.exe 2868 cmd.exe 3304 cmd.exe 4020 cmd.exe 200 cmd.exe 2976 cmd.exe 5964 cmd.exe 5392 cmd.exe 5072 cmd.exe 5520 cmd.exe 4880 cmd.exe 4188 cmd.exe 6084 cmd.exe 2996 cmd.exe 6052 cmd.exe 6060 cmd.exe 5952 cmd.exe 4508 cmd.exe 1264 cmd.exe 4180 cmd.exe 5164 cmd.exe 1976 cmd.exe 4356 cmd.exe 4644 cmd.exe 5576 cmd.exe 1208 cmd.exe 1872 cmd.exe 3552 cmd.exe 3484 cmd.exe 1696 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5908 1984 WerFault.exe 89 3448 4396 WerFault.exe 94 4460 1552 WerFault.exe 100 1788 1204 WerFault.exe 105 1276 5880 WerFault.exe 110 2860 5956 WerFault.exe 115 3564 1412 WerFault.exe 120 1696 3408 WerFault.exe 125 4792 4640 WerFault.exe 130 3964 2304 WerFault.exe 135 5036 3256 WerFault.exe 140 5184 5596 WerFault.exe 145 4040 5776 WerFault.exe 150 5936 6064 WerFault.exe 155 4004 1256 WerFault.exe 160 4764 3336 WerFault.exe 165 2848 4820 WerFault.exe 170 4312 5448 WerFault.exe 175 6056 4788 WerFault.exe 180 5796 3388 WerFault.exe 185 2888 5384 WerFault.exe 190 2836 5368 WerFault.exe 195 3508 4148 WerFault.exe 200 5452 4776 WerFault.exe 205 1600 6004 WerFault.exe 210 1640 1572 WerFault.exe 215 5228 1520 WerFault.exe 220 5720 3468 WerFault.exe 225 4672 4372 WerFault.exe 230 6056 3372 WerFault.exe 235 3548 5668 WerFault.exe 240 4412 5948 WerFault.exe 245 5700 1304 WerFault.exe 250 244 3464 WerFault.exe 255 3396 404 WerFault.exe 260 5244 4252 WerFault.exe 265 5704 5716 WerFault.exe 270 5904 2368 WerFault.exe 275 1524 2924 WerFault.exe 280 908 4480 WerFault.exe 285 4328 4884 WerFault.exe 290 4924 2652 WerFault.exe 295 4916 3120 WerFault.exe 300 4408 4332 WerFault.exe 305 3780 4268 WerFault.exe 310 2900 5400 WerFault.exe 315 2800 2000 WerFault.exe 320 3352 5824 WerFault.exe 325 2840 3980 WerFault.exe 330 572 3692 WerFault.exe 335 6056 2344 WerFault.exe 340 1616 2176 WerFault.exe 345 2180 3668 WerFault.exe 350 108 1064 WerFault.exe 355 3380 3872 WerFault.exe 360 1600 6008 WerFault.exe 365 4860 4040 WerFault.exe 370 2224 2724 WerFault.exe 375 1160 2636 WerFault.exe 380 5428 1488 WerFault.exe 385 1940 5876 WerFault.exe 390 4612 4536 WerFault.exe 395 5260 4156 WerFault.exe 400 236 6116 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHNYVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXUMXCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKZDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADOOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIGTON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIJXDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBYWBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZGQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWXIRXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGJATH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRQYINY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPRABIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRBVTIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLSCSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMYOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXJDQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe 1984 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe 4396 URCS.exe 4396 URCS.exe 1552 WFNQ.exe 1552 WFNQ.exe 1204 NIGTON.exe 1204 NIGTON.exe 5880 IVLKQ.exe 5880 IVLKQ.exe 5956 KJCM.exe 5956 KJCM.exe 1412 LMGIPWP.exe 1412 LMGIPWP.exe 3408 JHX.exe 3408 JHX.exe 4640 CAM.exe 4640 CAM.exe 2304 XNRLN.exe 2304 XNRLN.exe 3256 WYUB.exe 3256 WYUB.exe 5596 OBYWBW.exe 5596 OBYWBW.exe 5776 AJMEO.exe 5776 AJMEO.exe 6064 VEROYOC.exe 6064 VEROYOC.exe 1256 ZMYOK.exe 1256 ZMYOK.exe 3336 JKDIRHH.exe 3336 JKDIRHH.exe 4820 JPE.exe 4820 JPE.exe 5448 DLIGD.exe 5448 DLIGD.exe 4788 CAUJQ.exe 4788 CAUJQ.exe 3388 IWTKVC.exe 3388 IWTKVC.exe 5384 MEZ.exe 5384 MEZ.exe 5368 QUGSTE.exe 5368 QUGSTE.exe 4148 ASUMB.exe 4148 ASUMB.exe 4776 CPZZI.exe 4776 CPZZI.exe 6004 KVMF.exe 6004 KVMF.exe 1572 EIJXDB.exe 1572 EIJXDB.exe 1520 JJTZH.exe 1520 JJTZH.exe 3468 EWXIRXX.exe 3468 EWXIRXX.exe 4372 XPFTJYF.exe 4372 XPFTJYF.exe 3372 GXH.exe 3372 GXH.exe 5668 QXJDQ.exe 5668 QXJDQ.exe 5948 UDBTG.exe 5948 UDBTG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1984 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe 1984 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe 4396 URCS.exe 4396 URCS.exe 1552 WFNQ.exe 1552 WFNQ.exe 1204 NIGTON.exe 1204 NIGTON.exe 5880 IVLKQ.exe 5880 IVLKQ.exe 5956 KJCM.exe 5956 KJCM.exe 1412 LMGIPWP.exe 1412 LMGIPWP.exe 3408 JHX.exe 3408 JHX.exe 4640 CAM.exe 4640 CAM.exe 2304 XNRLN.exe 2304 XNRLN.exe 3256 WYUB.exe 3256 WYUB.exe 5596 OBYWBW.exe 5596 OBYWBW.exe 5776 AJMEO.exe 5776 AJMEO.exe 6064 VEROYOC.exe 6064 VEROYOC.exe 1256 ZMYOK.exe 1256 ZMYOK.exe 3336 JKDIRHH.exe 3336 JKDIRHH.exe 4820 JPE.exe 4820 JPE.exe 5448 DLIGD.exe 5448 DLIGD.exe 4788 CAUJQ.exe 4788 CAUJQ.exe 3388 IWTKVC.exe 3388 IWTKVC.exe 5384 MEZ.exe 5384 MEZ.exe 5368 QUGSTE.exe 5368 QUGSTE.exe 4148 ASUMB.exe 4148 ASUMB.exe 4776 CPZZI.exe 4776 CPZZI.exe 6004 KVMF.exe 6004 KVMF.exe 1572 EIJXDB.exe 1572 EIJXDB.exe 1520 JJTZH.exe 1520 JJTZH.exe 3468 EWXIRXX.exe 3468 EWXIRXX.exe 4372 XPFTJYF.exe 4372 XPFTJYF.exe 3372 GXH.exe 3372 GXH.exe 5668 QXJDQ.exe 5668 QXJDQ.exe 5948 UDBTG.exe 5948 UDBTG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 4020 1984 2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe 90 PID 4020 wrote to memory of 4396 4020 cmd.exe 94 PID 4396 wrote to memory of 4296 4396 URCS.exe 96 PID 4296 wrote to memory of 1552 4296 cmd.exe 100 PID 1552 wrote to memory of 5144 1552 WFNQ.exe 101 PID 5144 wrote to memory of 1204 5144 cmd.exe 105 PID 1204 wrote to memory of 568 1204 NIGTON.exe 106 PID 568 wrote to memory of 5880 568 cmd.exe 110 PID 5880 wrote to memory of 5932 5880 IVLKQ.exe 111 PID 5932 wrote to memory of 5956 5932 cmd.exe 115 PID 5956 wrote to memory of 5520 5956 KJCM.exe 116 PID 5520 wrote to memory of 1412 5520 cmd.exe 120 PID 1412 wrote to memory of 936 1412 LMGIPWP.exe 121 PID 936 wrote to memory of 3408 936 cmd.exe 125 PID 3408 wrote to memory of 200 3408 JHX.exe 126 PID 200 wrote to memory of 4640 200 cmd.exe 130 PID 4640 wrote to memory of 6096 4640 CAM.exe 131 PID 6096 wrote to memory of 2304 6096 cmd.exe 135 PID 2304 wrote to memory of 4880 2304 XNRLN.exe 136 PID 4880 wrote to memory of 3256 4880 cmd.exe 140 PID 3256 wrote to memory of 5164 3256 WYUB.exe 141 PID 5164 wrote to memory of 5596 5164 cmd.exe 145 PID 5596 wrote to memory of 4384 5596 OBYWBW.exe 146 PID 4384 wrote to memory of 5776 4384 cmd.exe 150 PID 5776 wrote to memory of 4188 5776 AJMEO.exe 151 PID 4188 wrote to memory of 6064 4188 cmd.exe 155 PID 6064 wrote to memory of 2520 6064 VEROYOC.exe 156 PID 2520 wrote to memory of 1256 2520 cmd.exe 160 PID 1256 wrote to memory of 4000 1256 ZMYOK.exe 161 PID 4000 wrote to memory of 3336 4000 cmd.exe 165 PID 3336 wrote to memory of 6140 3336 JKDIRHH.exe 166 PID 6140 wrote to memory of 4820 6140 cmd.exe 170 PID 4820 wrote to memory of 5492 4820 JPE.exe 171 PID 5492 wrote to memory of 5448 5492 cmd.exe 175 PID 5448 wrote to memory of 5612 5448 DLIGD.exe 176 PID 5612 wrote to memory of 4788 5612 cmd.exe 180 PID 4788 wrote to memory of 2976 4788 CAUJQ.exe 181 PID 2976 wrote to memory of 3388 2976 cmd.exe 185 PID 3388 wrote to memory of 5748 3388 IWTKVC.exe 186 PID 5748 wrote to memory of 5384 5748 cmd.exe 190 PID 5384 wrote to memory of 4824 5384 MEZ.exe 191 PID 4824 wrote to memory of 5368 4824 cmd.exe 195 PID 5368 wrote to memory of 3032 5368 QUGSTE.exe 196 PID 3032 wrote to memory of 4148 3032 cmd.exe 200 PID 4148 wrote to memory of 4960 4148 ASUMB.exe 201 PID 4960 wrote to memory of 4776 4960 cmd.exe 205 PID 4776 wrote to memory of 1180 4776 CPZZI.exe 206 PID 1180 wrote to memory of 6004 1180 cmd.exe 210 PID 6004 wrote to memory of 4032 6004 KVMF.exe 211 PID 4032 wrote to memory of 1572 4032 cmd.exe 215 PID 1572 wrote to memory of 992 1572 EIJXDB.exe 216 PID 992 wrote to memory of 1520 992 cmd.exe 220 PID 1520 wrote to memory of 3324 1520 JJTZH.exe 221 PID 3324 wrote to memory of 3468 3324 cmd.exe 225 PID 3468 wrote to memory of 3552 3468 EWXIRXX.exe 226 PID 3552 wrote to memory of 4372 3552 cmd.exe 230 PID 4372 wrote to memory of 5436 4372 XPFTJYF.exe 231 PID 5436 wrote to memory of 3372 5436 cmd.exe 235 PID 3372 wrote to memory of 1420 3372 GXH.exe 236 PID 1420 wrote to memory of 5668 1420 cmd.exe 240 PID 5668 wrote to memory of 4652 5668 QXJDQ.exe 241 PID 4652 wrote to memory of 5948 4652 cmd.exe 245 PID 5948 wrote to memory of 5868 5948 UDBTG.exe 246 PID 5868 wrote to memory of 1304 5868 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_eca4f2a1f8c95475ec50449ed4713a49_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URCS.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\windows\URCS.exeC:\windows\URCS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFNQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\SysWOW64\WFNQ.exeC:\windows\system32\WFNQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIGTON.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\system\NIGTON.exeC:\windows\system\NIGTON.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVLKQ.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:568 -
C:\windows\IVLKQ.exeC:\windows\IVLKQ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMGIPWP.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\system\LMGIPWP.exeC:\windows\system\LMGIPWP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\JHX.exeC:\windows\JHX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\CAM.exeC:\windows\CAM.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNRLN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\XNRLN.exeC:\windows\system32\XNRLN.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYUB.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\SysWOW64\WYUB.exeC:\windows\system32\WYUB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBYWBW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\system\OBYWBW.exeC:\windows\system\OBYWBW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMEO.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\SysWOW64\AJMEO.exeC:\windows\system32\AJMEO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEROYOC.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\VEROYOC.exeC:\windows\VEROYOC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZMYOK.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\ZMYOK.exeC:\windows\ZMYOK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKDIRHH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\windows\system\JKDIRHH.exeC:\windows\system\JKDIRHH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\SysWOW64\JPE.exeC:\windows\system32\JPE.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLIGD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\DLIGD.exeC:\windows\DLIGD.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAUJQ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\CAUJQ.exeC:\windows\CAUJQ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWTKVC.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\IWTKVC.exeC:\windows\system\IWTKVC.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\system\MEZ.exeC:\windows\system\MEZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUGSTE.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\system\QUGSTE.exeC:\windows\system\QUGSTE.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASUMB.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\SysWOW64\ASUMB.exeC:\windows\system32\ASUMB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPZZI.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\system\CPZZI.exeC:\windows\system\CPZZI.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVMF.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\KVMF.exeC:\windows\KVMF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EIJXDB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\windows\system\EIJXDB.exeC:\windows\system\EIJXDB.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJTZH.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\system\JJTZH.exeC:\windows\system\JJTZH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWXIRXX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\system\EWXIRXX.exeC:\windows\system\EWXIRXX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPFTJYF.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\XPFTJYF.exeC:\windows\XPFTJYF.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXH.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\GXH.exeC:\windows\system32\GXH.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXJDQ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\SysWOW64\QXJDQ.exeC:\windows\system32\QXJDQ.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDBTG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\UDBTG.exeC:\windows\UDBTG.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELDGJC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\ELDGJC.exeC:\windows\ELDGJC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTKG.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3164 -
C:\windows\system\HTKG.exeC:\windows\system\HTKG.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KOOPGM.exe.bat" "68⤵PID:4620
-
C:\windows\system\KOOPGM.exeC:\windows\system\KOOPGM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCTZQMG.exe.bat" "70⤵
- Executes a command shell one-liner
PID:6084 -
C:\windows\SysWOW64\FCTZQMG.exeC:\windows\system32\FCTZQMG.exe71⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCVE.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4508 -
C:\windows\SysWOW64\OCVE.exeC:\windows\system32\OCVE.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKXRXOK.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\windows\SysWOW64\XKXRXOK.exeC:\windows\system32\XKXRXOK.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\windows\SysWOW64\OQI.exeC:\windows\system32\OQI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EGJATH.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1976 -
C:\windows\SysWOW64\EGJATH.exeC:\windows\system32\EGJATH.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PYETUOC.exe.bat" "80⤵PID:3784
-
C:\windows\system\PYETUOC.exeC:\windows\system\PYETUOC.exe81⤵
- Executes dropped EXE
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBNXN.exe.bat" "82⤵PID:2600
-
C:\windows\system\EBNXN.exeC:\windows\system\EBNXN.exe83⤵
- Executes dropped EXE
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCPKQGN.exe.bat" "84⤵PID:1252
-
C:\windows\OCPKQGN.exeC:\windows\OCPKQGN.exe85⤵
- Executes dropped EXE
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPU.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2488 -
C:\windows\SysWOW64\IPU.exeC:\windows\system32\IPU.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKZDD.exe.bat" "88⤵PID:5580
-
C:\windows\system\DKZDD.exeC:\windows\system\DKZDD.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFI.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\windows\system\SFI.exeC:\windows\system\SFI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLA.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\windows\system\DYLA.exeC:\windows\system\DYLA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQOTE.exe.bat" "94⤵PID:2016
-
C:\windows\SysWOW64\PQOTE.exeC:\windows\system32\PQOTE.exe95⤵
- Executes dropped EXE
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRQYINY.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5952 -
C:\windows\GRQYINY.exeC:\windows\GRQYINY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMV.exe.bat" "98⤵PID:3392
-
C:\windows\system\BMV.exeC:\windows\system\BMV.exe99⤵
- Executes dropped EXE
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCGLNSV.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\windows\ZCGLNSV.exeC:\windows\ZCGLNSV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZHG.exe.bat" "102⤵PID:2864
-
C:\windows\system\ZHG.exeC:\windows\system\ZHG.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDLJ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4368 -
C:\windows\system\UDLJ.exeC:\windows\system\UDLJ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JYVNKRN.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5312 -
C:\windows\system\JYVNKRN.exeC:\windows\system\JYVNKRN.exe107⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYXS.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3484 -
C:\windows\system\AYXS.exeC:\windows\system\AYXS.exe109⤵
- Executes dropped EXE
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VLCBX.exe.bat" "110⤵PID:3360
-
C:\windows\SysWOW64\VLCBX.exeC:\windows\system32\VLCBX.exe111⤵
- Executes dropped EXE
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUWO.exe.bat" "112⤵PID:5896
-
C:\windows\EUWO.exeC:\windows\EUWO.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPNTM.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4356 -
C:\windows\SysWOW64\TPNTM.exeC:\windows\system32\TPNTM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUNEW.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1300 -
C:\windows\SysWOW64\HUNEW.exeC:\windows\system32\HUNEW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HPRABIA.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4164 -
C:\windows\HPRABIA.exeC:\windows\HPRABIA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LFXI.exe.bat" "120⤵PID:5820
-
C:\windows\SysWOW64\LFXI.exeC:\windows\system32\LFXI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-