Analysis
- max time kernel
89s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe
- Size 208KB
- Sample261002-2hk6asxtdz
- SHA256 457025a549a2a3c3ad8ffb0a196cf051d0c9bb9d3977da4aca18192e4263ab00
- MD5 f411d4f48b8819f8776d5d3b9ca52dfc
- SHA1 11c570f7c62ab6545e6b8436d7eb69cabe4018ff
- SHA512 cb21292a413e90f332b604c743b3c19d20d0807018df5c23ef5f3e1871d9fb9956ddaf09afe418a6b2c63ed92d338590e46efe12373a78bfc092229c375cd1b2
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfo4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOwkEj1
- TLSH T1DB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 844 DEMKS.exe 3872 CZR.exe 808 SPSMJTZ.exe 3612 HSBQU.exe 1980 QSDVFL.exe 5444 CIK.exe 5644 BTNUSKM.exe 3640 FBBUF.exe 5464 MRC.exe 2504 PEHCV.exe 4564 IHLYBNV.exe 2316 LXSG.exe 2800 DYULRDL.exe 1780 STDQC.exe 2308 NOIZMQJ.exe 4520 CEJ.exe 3280 PHR.exe 4872 ZPTCK.exe 1616 USK.exe 1448 DAMGCC.exe 3368 HIS.exe 1840 CEXPY.exe 5048 KJPEAZ.exe 4920 EWU.exe 1968 DUOQXM.exe 5000 MVIVBJX.exe 3860 BLRVHF.exe 6096 WYN.exe 1164 CYVSB.exe 3380 VBHNGPL.exe 5032 XPEX.exe 2208 VPLLZR.exe 2636 KFUK.exe 616 UDAEVVZ.exe 3420 ADHS.exe 896 MWKLN.exe 6000 GJHUPWE.exe 4532 PRJ.exe 5104 VRRNJW.exe 4860 HKUGSLX.exe 2296 WFDKD.exe 1304 QSITNYM.exe 1432 IBK.exe 5204 COPQB.exe 3048 AOXEKXN.exe 1436 DCBN.exe 4496 OUW.exe 5636 XCYLGK.exe 4480 NXIP.exe 6012 WYKUU.exe 2564 QTPEFUK.exe 4620 WTWA.exe 3836 RHBJYW.exe 4324 TECDE.exe 3428 FNJL.exe 4880 DNRZZ.exe 3736 OFMKIN.exe 4400 RTQBKMK.exe 4216 YJRSRI.exe 1136 UOXQYK.exe 248 GHAIGZQ.exe 2812 KPHI.exe 4364 EKMSCJ.exe 1640 HYQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WYN.exe BLRVHF.exe File opened for modification C:\windows\SysWOW64\TECDE.exe RHBJYW.exe File created C:\windows\SysWOW64\FNJL.exe TECDE.exe File created C:\windows\SysWOW64\EXU.exe IZWORJT.exe File created C:\windows\SysWOW64\FBBUF.exe BTNUSKM.exe File opened for modification C:\windows\SysWOW64\FNJL.exe TECDE.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe QEFFP.exe File created C:\windows\SysWOW64\OIZ.exe.bat XAFHD.exe File created C:\windows\SysWOW64\SQOUTZ.exe OIZ.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe FRNH.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat FRNH.exe File created C:\windows\SysWOW64\OLQWREI.exe.bat RAGAZV.exe File created C:\windows\SysWOW64\QSDVFL.exe.bat HSBQU.exe File opened for modification C:\windows\SysWOW64\GJHUPWE.exe MWKLN.exe File created C:\windows\SysWOW64\GJHUPWE.exe.bat MWKLN.exe File created C:\windows\SysWOW64\OUW.exe.bat DCBN.exe File opened for modification C:\windows\SysWOW64\WTWA.exe QTPEFUK.exe File created C:\windows\SysWOW64\TECDE.exe RHBJYW.exe File opened for modification C:\windows\SysWOW64\LGE.exe LBLFHSZ.exe File opened for modification C:\windows\SysWOW64\IZWORJT.exe CZOAAH.exe File created C:\windows\SysWOW64\LGE.exe LBLFHSZ.exe File created C:\windows\SysWOW64\PRJ.exe GJHUPWE.exe File opened for modification C:\windows\SysWOW64\FBBUF.exe BTNUSKM.exe File opened for modification C:\windows\SysWOW64\IHLYBNV.exe PEHCV.exe File created C:\windows\SysWOW64\GJHUPWE.exe MWKLN.exe File created C:\windows\SysWOW64\HMJR.exe.bat LGE.exe File opened for modification C:\windows\SysWOW64\EXU.exe IZWORJT.exe File created C:\windows\SysWOW64\XAFHD.exe EXU.exe File created C:\windows\SysWOW64\NOIZMQJ.exe STDQC.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat EWU.exe File opened for modification C:\windows\SysWOW64\COPQB.exe IBK.exe File opened for modification C:\windows\SysWOW64\SQOUTZ.exe OIZ.exe File opened for modification C:\windows\SysWOW64\BIBVDX.exe ZSATFI.exe File created C:\windows\SysWOW64\RFCX.exe WKXNJGV.exe File opened for modification C:\windows\SysWOW64\RFCX.exe WKXNJGV.exe File created C:\windows\SysWOW64\OLQWREI.exe RAGAZV.exe File opened for modification C:\windows\SysWOW64\UDAEVVZ.exe KFUK.exe File created C:\windows\SysWOW64\PRJ.exe.bat GJHUPWE.exe File created C:\windows\SysWOW64\COPQB.exe IBK.exe File created C:\windows\SysWOW64\AOXEKXN.exe.bat COPQB.exe File opened for modification C:\windows\SysWOW64\OUW.exe DCBN.exe File opened for modification C:\windows\SysWOW64\XAFHD.exe EXU.exe File created C:\windows\SysWOW64\BIBVDX.exe.bat ZSATFI.exe File created C:\windows\SysWOW64\QWY.exe SJZTI.exe File created C:\windows\SysWOW64\IHLYBNV.exe.bat PEHCV.exe File opened for modification C:\windows\SysWOW64\PRJ.exe GJHUPWE.exe File opened for modification C:\windows\SysWOW64\AOXEKXN.exe COPQB.exe File created C:\windows\SysWOW64\WEXZAB.exe FRNH.exe File created C:\windows\SysWOW64\QTDIOKX.exe.bat MDXIBZB.exe File created C:\windows\SysWOW64\WTWA.exe.bat QTPEFUK.exe File created C:\windows\SysWOW64\SQOUTZ.exe.bat OIZ.exe File created C:\windows\SysWOW64\QTDIOKX.exe MDXIBZB.exe File created C:\windows\SysWOW64\PCPGEP.exe.bat UHKXB.exe File created C:\windows\SysWOW64\TIHVU.exe.bat PCPGEP.exe File opened for modification C:\windows\SysWOW64\WYN.exe BLRVHF.exe File created C:\windows\SysWOW64\IHLYBNV.exe PEHCV.exe File created C:\windows\SysWOW64\WTWA.exe QTPEFUK.exe File created C:\windows\SysWOW64\HYQ.exe EKMSCJ.exe File opened for modification C:\windows\SysWOW64\HMJR.exe LGE.exe File opened for modification C:\windows\SysWOW64\PCPGEP.exe UHKXB.exe File created C:\windows\SysWOW64\RFCX.exe.bat WKXNJGV.exe File created C:\windows\SysWOW64\COPQB.exe.bat IBK.exe File created C:\windows\SysWOW64\LGE.exe.bat LBLFHSZ.exe File created C:\windows\SysWOW64\XAFHD.exe.bat EXU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MVIVBJX.exe.bat DUOQXM.exe File created C:\windows\system\ONPG.exe YKGTZA.exe File created C:\windows\AIQM.exe QSKRGMK.exe File created C:\windows\system\QSITNYM.exe WFDKD.exe File created C:\windows\WKXNJGV.exe.bat WEXZAB.exe File created C:\windows\system\CZR.exe.bat DEMKS.exe File opened for modification C:\windows\system\LXSG.exe IHLYBNV.exe File created C:\windows\system\STDQC.exe.bat DYULRDL.exe File created C:\windows\TEY.exe.bat WYA.exe File opened for modification C:\windows\BDGSEZ.exe GIBJ.exe File created C:\windows\system\UHKXB.exe.bat LGI.exe File created C:\windows\VPLLZR.exe XPEX.exe File created C:\windows\DCBN.exe.bat AOXEKXN.exe File created C:\windows\DCBN.exe AOXEKXN.exe File opened for modification C:\windows\WYKUU.exe NXIP.exe File opened for modification C:\windows\system\JPRPM.exe JJRAKIE.exe File created C:\windows\GIBJ.exe.bat BIBVDX.exe File created C:\windows\system\PCH.exe LUAXDD.exe File created C:\windows\system\QDT.exe.bat GVRDHF.exe File opened for modification C:\windows\system\VBHNGPL.exe CYVSB.exe File opened for modification C:\windows\system\HKUGSLX.exe VRRNJW.exe File created C:\windows\KQSRR.exe AIQM.exe File created C:\windows\MDXIBZB.exe.bat KQSRR.exe File created C:\windows\system\CZR.exe DEMKS.exe File created C:\windows\ZPTCK.exe PHR.exe File created C:\windows\system\MWKLN.exe.bat ADHS.exe File created C:\windows\ZSATFI.exe.bat JPRPM.exe File created C:\windows\HIS.exe.bat DAMGCC.exe File created C:\windows\system\LXSG.exe.bat IHLYBNV.exe File opened for modification C:\windows\RHBJYW.exe WTWA.exe File created C:\windows\system\EKMSCJ.exe.bat KPHI.exe File created C:\windows\BDGSEZ.exe GIBJ.exe File opened for modification C:\windows\system\LUAXDD.exe DOAIC.exe File opened for modification C:\windows\GVRDHF.exe AUKQ.exe File created C:\windows\system\UHKXB.exe LGI.exe File opened for modification C:\windows\system\MRC.exe FBBUF.exe File opened for modification C:\windows\CEJ.exe NOIZMQJ.exe File created C:\windows\AUKQ.exe.bat PCH.exe File created C:\windows\system\BWOB.exe.bat QDT.exe File opened for modification C:\windows\MDXIBZB.exe KQSRR.exe File created C:\windows\DYULRDL.exe.bat LXSG.exe File created C:\windows\EWU.exe.bat KJPEAZ.exe File opened for modification C:\windows\QEFFP.exe TEY.exe File created C:\windows\JJRAKIE.exe YRW.exe File opened for modification C:\windows\system\FRNH.exe WRLCHZC.exe File created C:\windows\GVRDHF.exe AUKQ.exe File opened for modification C:\windows\system\CZR.exe DEMKS.exe File opened for modification C:\windows\system\BDY.exe IAUPUU.exe File created C:\windows\system\PCH.exe.bat LUAXDD.exe File opened for modification C:\windows\SJZTI.exe BWOB.exe File opened for modification C:\windows\GHAIGZQ.exe UOXQYK.exe File opened for modification C:\windows\AUKQ.exe PCH.exe File opened for modification C:\windows\system\USK.exe ZPTCK.exe File opened for modification C:\windows\system\KJPEAZ.exe CEXPY.exe File created C:\windows\system\XCYLGK.exe OUW.exe File opened for modification C:\windows\ZNH.exe OVMFEKM.exe File created C:\windows\DEMKS.exe 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe File created C:\windows\CEXPY.exe.bat HIS.exe File opened for modification C:\windows\system\CYVSB.exe WYN.exe File opened for modification C:\windows\system\WRLCHZC.exe BDGSEZ.exe File opened for modification C:\windows\system\IBK.exe QSITNYM.exe File created C:\windows\system\MRC.exe.bat FBBUF.exe File opened for modification C:\windows\system\SPSMJTZ.exe CZR.exe File opened for modification C:\windows\system\BLVTP.exe HYQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4308 cmd.exe 4644 cmd.exe 4420 cmd.exe 5596 cmd.exe 5376 cmd.exe 4636 cmd.exe 3352 cmd.exe 1724 cmd.exe 4228 cmd.exe 4120 cmd.exe 1596 cmd.exe 5064 cmd.exe 5300 cmd.exe 2600 cmd.exe 4700 cmd.exe 3700 cmd.exe 3436 cmd.exe 2580 cmd.exe 5528 cmd.exe 3400 cmd.exe 2188 cmd.exe 4412 cmd.exe 5088 cmd.exe 2656 cmd.exe 1084 cmd.exe 4492 cmd.exe 6116 cmd.exe 4164 cmd.exe 4848 cmd.exe 1328 cmd.exe 3000 cmd.exe 2476 cmd.exe 5220 cmd.exe 2992 cmd.exe 4840 cmd.exe 4736 cmd.exe 3908 cmd.exe 3588 cmd.exe 5436 cmd.exe 1340 cmd.exe 5844 cmd.exe 900 cmd.exe 624 cmd.exe 4824 cmd.exe 948 cmd.exe 4244 cmd.exe 1948 cmd.exe 5684 cmd.exe 2952 cmd.exe 3532 cmd.exe 4608 cmd.exe 2036 cmd.exe 1452 cmd.exe 1792 cmd.exe 5004 cmd.exe 1612 cmd.exe 5948 cmd.exe 4184 cmd.exe 2840 cmd.exe 5600 cmd.exe 3124 cmd.exe 1224 cmd.exe 5804 cmd.exe 1116 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3688 5312 WerFault.exe 87 616 844 WerFault.exe 93 5952 3872 WerFault.exe 99 5356 808 WerFault.exe 104 1812 3612 WerFault.exe 109 1808 1980 WerFault.exe 114 5420 5444 WerFault.exe 119 5008 5644 WerFault.exe 124 4596 3640 WerFault.exe 129 3460 5464 WerFault.exe 134 4724 2504 WerFault.exe 139 1840 4564 WerFault.exe 144 1852 2316 WerFault.exe 149 2580 2800 WerFault.exe 154 3408 1780 WerFault.exe 159 5768 2308 WerFault.exe 164 4676 4520 WerFault.exe 169 1200 3280 WerFault.exe 174 1764 4872 WerFault.exe 179 4904 1616 WerFault.exe 184 5092 1448 WerFault.exe 189 252 3368 WerFault.exe 194 3824 1840 WerFault.exe 199 2240 5048 WerFault.exe 204 5772 4920 WerFault.exe 209 896 1968 WerFault.exe 214 5672 5000 WerFault.exe 219 1200 3860 WerFault.exe 224 4752 6096 WerFault.exe 229 2616 1164 WerFault.exe 234 1328 3380 WerFault.exe 239 5792 5032 WerFault.exe 244 4932 2208 WerFault.exe 249 4812 2636 WerFault.exe 254 3244 616 WerFault.exe 259 1996 3420 WerFault.exe 264 3412 896 WerFault.exe 269 6060 6000 WerFault.exe 274 4704 4532 WerFault.exe 280 1392 5104 WerFault.exe 285 3496 4860 WerFault.exe 290 5752 2296 WerFault.exe 295 4244 1304 WerFault.exe 300 3488 1432 WerFault.exe 305 1496 5204 WerFault.exe 310 4488 3048 WerFault.exe 315 5828 1436 WerFault.exe 320 3224 4496 WerFault.exe 325 3712 5636 WerFault.exe 330 4916 4480 WerFault.exe 335 4576 6012 WerFault.exe 340 5344 2564 WerFault.exe 345 2556 4620 WerFault.exe 350 2332 3836 WerFault.exe 355 1268 4324 WerFault.exe 360 1812 3428 WerFault.exe 365 5824 4880 WerFault.exe 370 5548 3736 WerFault.exe 375 4892 4400 WerFault.exe 380 5408 4216 WerFault.exe 385 4796 1136 WerFault.exe 390 560 248 WerFault.exe 395 4256 2812 WerFault.exe 400 4776 4364 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDAEVVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKGTZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAGAZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AUKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEXPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSKRGMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSDVFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSATFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSITNYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZWORJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWKLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPSMJTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFDKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIBVDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRLCHZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDXIBZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPTCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBBUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COPQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEMKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEHCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNRZZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGSEZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5312 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe 5312 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe 844 DEMKS.exe 844 DEMKS.exe 3872 CZR.exe 3872 CZR.exe 808 SPSMJTZ.exe 808 SPSMJTZ.exe 3612 HSBQU.exe 3612 HSBQU.exe 1980 QSDVFL.exe 1980 QSDVFL.exe 5444 CIK.exe 5444 CIK.exe 5644 BTNUSKM.exe 5644 BTNUSKM.exe 3640 FBBUF.exe 3640 FBBUF.exe 5464 MRC.exe 5464 MRC.exe 2504 PEHCV.exe 2504 PEHCV.exe 4564 IHLYBNV.exe 4564 IHLYBNV.exe 2316 LXSG.exe 2316 LXSG.exe 2800 DYULRDL.exe 2800 DYULRDL.exe 1780 STDQC.exe 1780 STDQC.exe 2308 NOIZMQJ.exe 2308 NOIZMQJ.exe 4520 CEJ.exe 4520 CEJ.exe 3280 PHR.exe 3280 PHR.exe 4872 ZPTCK.exe 4872 ZPTCK.exe 1616 USK.exe 1616 USK.exe 1448 DAMGCC.exe 1448 DAMGCC.exe 3368 HIS.exe 3368 HIS.exe 1840 CEXPY.exe 1840 CEXPY.exe 5048 KJPEAZ.exe 5048 KJPEAZ.exe 4920 EWU.exe 4920 EWU.exe 1968 DUOQXM.exe 1968 DUOQXM.exe 5000 MVIVBJX.exe 5000 MVIVBJX.exe 3860 BLRVHF.exe 3860 BLRVHF.exe 6096 WYN.exe 6096 WYN.exe 1164 CYVSB.exe 1164 CYVSB.exe 3380 VBHNGPL.exe 3380 VBHNGPL.exe 5032 XPEX.exe 5032 XPEX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5312 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe 5312 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe 844 DEMKS.exe 844 DEMKS.exe 3872 CZR.exe 3872 CZR.exe 808 SPSMJTZ.exe 808 SPSMJTZ.exe 3612 HSBQU.exe 3612 HSBQU.exe 1980 QSDVFL.exe 1980 QSDVFL.exe 5444 CIK.exe 5444 CIK.exe 5644 BTNUSKM.exe 5644 BTNUSKM.exe 3640 FBBUF.exe 3640 FBBUF.exe 5464 MRC.exe 5464 MRC.exe 2504 PEHCV.exe 2504 PEHCV.exe 4564 IHLYBNV.exe 4564 IHLYBNV.exe 2316 LXSG.exe 2316 LXSG.exe 2800 DYULRDL.exe 2800 DYULRDL.exe 1780 STDQC.exe 1780 STDQC.exe 2308 NOIZMQJ.exe 2308 NOIZMQJ.exe 4520 CEJ.exe 4520 CEJ.exe 3280 PHR.exe 3280 PHR.exe 4872 ZPTCK.exe 4872 ZPTCK.exe 1616 USK.exe 1616 USK.exe 1448 DAMGCC.exe 1448 DAMGCC.exe 3368 HIS.exe 3368 HIS.exe 1840 CEXPY.exe 1840 CEXPY.exe 5048 KJPEAZ.exe 5048 KJPEAZ.exe 4920 EWU.exe 4920 EWU.exe 1968 DUOQXM.exe 1968 DUOQXM.exe 5000 MVIVBJX.exe 5000 MVIVBJX.exe 3860 BLRVHF.exe 3860 BLRVHF.exe 6096 WYN.exe 6096 WYN.exe 1164 CYVSB.exe 1164 CYVSB.exe 3380 VBHNGPL.exe 3380 VBHNGPL.exe 5032 XPEX.exe 5032 XPEX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5312 wrote to memory of 3708 5312 2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe 89 PID 3708 wrote to memory of 844 3708 cmd.exe 93 PID 844 wrote to memory of 4644 844 DEMKS.exe 95 PID 4644 wrote to memory of 3872 4644 cmd.exe 99 PID 3872 wrote to memory of 2600 3872 CZR.exe 100 PID 2600 wrote to memory of 808 2600 cmd.exe 104 PID 808 wrote to memory of 4276 808 SPSMJTZ.exe 105 PID 4276 wrote to memory of 3612 4276 cmd.exe 109 PID 3612 wrote to memory of 4200 3612 HSBQU.exe 110 PID 4200 wrote to memory of 1980 4200 cmd.exe 114 PID 1980 wrote to memory of 5088 1980 QSDVFL.exe 115 PID 5088 wrote to memory of 5444 5088 cmd.exe 119 PID 5444 wrote to memory of 2924 5444 CIK.exe 120 PID 2924 wrote to memory of 5644 2924 cmd.exe 124 PID 5644 wrote to memory of 2656 5644 BTNUSKM.exe 125 PID 2656 wrote to memory of 3640 2656 cmd.exe 129 PID 3640 wrote to memory of 3844 3640 FBBUF.exe 130 PID 3844 wrote to memory of 5464 3844 cmd.exe 134 PID 5464 wrote to memory of 5780 5464 MRC.exe 135 PID 5780 wrote to memory of 2504 5780 cmd.exe 139 PID 2504 wrote to memory of 4420 2504 PEHCV.exe 140 PID 4420 wrote to memory of 4564 4420 cmd.exe 144 PID 4564 wrote to memory of 3616 4564 IHLYBNV.exe 145 PID 3616 wrote to memory of 2316 3616 cmd.exe 149 PID 2316 wrote to memory of 3688 2316 LXSG.exe 150 PID 3688 wrote to memory of 2800 3688 cmd.exe 154 PID 2800 wrote to memory of 4432 2800 DYULRDL.exe 155 PID 4432 wrote to memory of 1780 4432 cmd.exe 159 PID 1780 wrote to memory of 5112 1780 STDQC.exe 160 PID 5112 wrote to memory of 2308 5112 cmd.exe 164 PID 2308 wrote to memory of 1056 2308 NOIZMQJ.exe 165 PID 1056 wrote to memory of 4520 1056 cmd.exe 169 PID 4520 wrote to memory of 5596 4520 CEJ.exe 170 PID 5596 wrote to memory of 3280 5596 cmd.exe 174 PID 3280 wrote to memory of 5420 3280 PHR.exe 175 PID 5420 wrote to memory of 4872 5420 cmd.exe 179 PID 4872 wrote to memory of 5912 4872 ZPTCK.exe 180 PID 5912 wrote to memory of 1616 5912 cmd.exe 184 PID 1616 wrote to memory of 4120 1616 USK.exe 185 PID 4120 wrote to memory of 1448 4120 cmd.exe 189 PID 1448 wrote to memory of 5332 1448 DAMGCC.exe 190 PID 5332 wrote to memory of 3368 5332 cmd.exe 194 PID 3368 wrote to memory of 2820 3368 HIS.exe 195 PID 2820 wrote to memory of 1840 2820 cmd.exe 199 PID 1840 wrote to memory of 1116 1840 CEXPY.exe 200 PID 1116 wrote to memory of 5048 1116 cmd.exe 204 PID 5048 wrote to memory of 6064 5048 KJPEAZ.exe 205 PID 6064 wrote to memory of 4920 6064 cmd.exe 209 PID 4920 wrote to memory of 5356 4920 EWU.exe 210 PID 5356 wrote to memory of 1968 5356 cmd.exe 214 PID 1968 wrote to memory of 1708 1968 DUOQXM.exe 215 PID 1708 wrote to memory of 5000 1708 cmd.exe 219 PID 5000 wrote to memory of 1596 5000 MVIVBJX.exe 220 PID 1596 wrote to memory of 3860 1596 cmd.exe 224 PID 3860 wrote to memory of 5892 3860 BLRVHF.exe 225 PID 5892 wrote to memory of 6096 5892 cmd.exe 229 PID 6096 wrote to memory of 2132 6096 WYN.exe 230 PID 2132 wrote to memory of 1164 2132 cmd.exe 234 PID 1164 wrote to memory of 2212 1164 CYVSB.exe 235 PID 2212 wrote to memory of 3380 2212 cmd.exe 239 PID 3380 wrote to memory of 2244 3380 VBHNGPL.exe 240 PID 2244 wrote to memory of 5032 2244 cmd.exe 244 PID 5032 wrote to memory of 4556 5032 XPEX.exe 245 PID 4556 wrote to memory of 2208 4556 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f411d4f48b8819f8776d5d3b9ca52dfc_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEMKS.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\windows\DEMKS.exeC:\windows\DEMKS.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZR.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\CZR.exeC:\windows\system\CZR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPSMJTZ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\system\SPSMJTZ.exeC:\windows\system\SPSMJTZ.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSDVFL.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\SysWOW64\QSDVFL.exeC:\windows\system32\QSDVFL.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\windows\CIK.exeC:\windows\CIK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBBUF.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\SysWOW64\FBBUF.exeC:\windows\system32\FBBUF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PEHCV.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\SysWOW64\PEHCV.exeC:\windows\system32\PEHCV.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXSG.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\system\LXSG.exeC:\windows\system\LXSG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOIZMQJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\windows\SysWOW64\NOIZMQJ.exeC:\windows\system32\NOIZMQJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\CEJ.exeC:\windows\CEJ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\USK.exeC:\windows\system\USK.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAMGCC.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\DAMGCC.exeC:\windows\system\DAMGCC.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\HIS.exeC:\windows\HIS.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEXPY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\CEXPY.exeC:\windows\CEXPY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\windows\EWU.exeC:\windows\EWU.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYN.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\WYN.exeC:\windows\system32\WYN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYVSB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\windows\system\CYVSB.exeC:\windows\system\CYVSB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPEX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\windows\system\XPEX.exeC:\windows\system\XPEX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe65⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "66⤵PID:4516
-
C:\windows\KFUK.exeC:\windows\KFUK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3400 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:624 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWKLN.exe.bat" "72⤵PID:4232
-
C:\windows\system\MWKLN.exeC:\windows\system\MWKLN.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJHUPWE.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1084 -
C:\windows\SysWOW64\GJHUPWE.exeC:\windows\system32\GJHUPWE.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "76⤵PID:5716
-
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "78⤵PID:3508
-
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKUGSLX.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5064 -
C:\windows\system\HKUGSLX.exeC:\windows\system\HKUGSLX.exe81⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "82⤵PID:6048
-
C:\windows\WFDKD.exeC:\windows\WFDKD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSITNYM.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5872 -
C:\windows\system\QSITNYM.exeC:\windows\system\QSITNYM.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBK.exe.bat" "86⤵PID:3824
-
C:\windows\system\IBK.exeC:\windows\system\IBK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COPQB.exe.bat" "88⤵PID:4812
-
C:\windows\SysWOW64\COPQB.exeC:\windows\system32\COPQB.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "92⤵PID:5916
-
C:\windows\DCBN.exeC:\windows\DCBN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUW.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2952 -
C:\windows\SysWOW64\OUW.exeC:\windows\system32\OUW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCYLGK.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4824 -
C:\windows\system\XCYLGK.exeC:\windows\system\XCYLGK.exe97⤵
- Executes dropped EXE
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2992 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe101⤵
- Executes dropped EXE
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTPEFUK.exe.bat" "102⤵PID:472
-
C:\windows\system\QTPEFUK.exeC:\windows\system\QTPEFUK.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTWA.exe.bat" "104⤵PID:4544
-
C:\windows\SysWOW64\WTWA.exeC:\windows\system32\WTWA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1852 -
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "108⤵PID:4224
-
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNJL.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\windows\SysWOW64\FNJL.exeC:\windows\system32\FNJL.exe111⤵
- Executes dropped EXE
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNRZZ.exe.bat" "112⤵PID:2076
-
C:\windows\DNRZZ.exeC:\windows\DNRZZ.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFMKIN.exe.bat" "114⤵PID:2144
-
C:\windows\system\OFMKIN.exeC:\windows\system\OFMKIN.exe115⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe117⤵
- Executes dropped EXE
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJRSRI.exe.bat" "118⤵PID:4668
-
C:\windows\YJRSRI.exeC:\windows\YJRSRI.exe119⤵
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOXQYK.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3588 -
C:\windows\UOXQYK.exeC:\windows\UOXQYK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-