Analysis
- max time kernel
95s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe
- Size 208KB
- Sample261002-3thpzsab39
- SHA256 ec42265febb2d7a02db72ef6268b4c3a00a5f74653f64a2010cda25a95377337
- MD5 e63cf6d9222218227c8cd03c93d0b167
- SHA1 93a4a4b03988465ae2ca5ed1a946549ea7e04e84
- SHA512 57610ac27317f150bb370645be32402138de24fa06d4a01f85799d1b7c781731fb953c483f79bffca29912fb7c96495d88cc903931e851582f4b4cad9f70f1f3
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfl4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOtkEj1
- TLSH T12D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4268 FJOBWDP.exe 2756 SEGJGMG.exe 3508 FPOAUPT.exe 5224 UFPZ.exe 4628 YNE.exe 1988 MYMYTG.exe 1052 OLR.exe 2520 YTTM.exe 2384 JMWFP.exe 4116 NUD.exe 4856 NXHJHBD.exe 2664 GSK.exe 1416 KIRNZJ.exe 3516 QIZ.exe 1336 KWDKS.exe 1848 WOGCAS.exe 248 SUE.exe 2200 YPDA.exe 5760 EPLOVZ.exe 4804 KQT.exe 4272 TQVH.exe 6072 ZQCVYTD.exe 5508 UEHM.exe 2536 FWK.exe 2328 CCIU.exe 1424 NULNYA.exe 4560 YNOFHHG.exe 3432 HAY.exe 3056 PGR.exe 2296 NGYAHL.exe 2104 QTDJRLN.exe 1240 QHD.exe 2692 SXJ.exe 2232 HASWT.exe 5272 WQTOAOO.exe 5052 GOHIHX.exe 2592 SGCBPEE.exe 4280 XGKOY.exe 5580 BOYWLRC.exe 3924 WCVG.exe 2420 RXAPXQ.exe 5228 LKF.exe 1872 DLHE.exe 3152 ALOSCQ.exe 3140 CJPUANN.exe 5980 FWM.exe 6080 JMBDXF.exe 1532 PMIRGZ.exe 5012 JAN.exe 2588 VSIT.exe 1892 NVM.exe 1272 ZOPQ.exe 1184 ZJTLRB.exe 4892 SMX.exe 4148 WCDPJKL.exe 4944 CCL.exe 3164 KIL.exe 3092 MGR.exe 2652 MBVHPPA.exe 1244 VOF.exe 1352 SULW.exe 5276 BUNBPB.exe 3252 NKT.exe 4044 NPUQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KWDKS.exe QIZ.exe File opened for modification C:\windows\SysWOW64\HAY.exe YNOFHHG.exe File opened for modification C:\windows\SysWOW64\TMRXLF.exe WOMA.exe File created C:\windows\SysWOW64\KIRNZJ.exe.bat GSK.exe File created C:\windows\SysWOW64\JAN.exe PMIRGZ.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat SMX.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe MGR.exe File opened for modification C:\windows\SysWOW64\HASWT.exe SXJ.exe File created C:\windows\SysWOW64\MBVHPPA.exe MGR.exe File opened for modification C:\windows\SysWOW64\VOF.exe MBVHPPA.exe File created C:\windows\SysWOW64\LRWTYNK.exe.bat IYFDD.exe File opened for modification C:\windows\SysWOW64\MSEWQ.exe VHGH.exe File created C:\windows\SysWOW64\SUE.exe WOGCAS.exe File created C:\windows\SysWOW64\SMX.exe ZJTLRB.exe File created C:\windows\SysWOW64\SMX.exe.bat ZJTLRB.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe SMX.exe File created C:\windows\SysWOW64\NQOQR.exe YVF.exe File created C:\windows\SysWOW64\KVUNY.exe NQOQR.exe File created C:\windows\SysWOW64\HASWT.exe SXJ.exe File opened for modification C:\windows\SysWOW64\JAN.exe PMIRGZ.exe File created C:\windows\SysWOW64\IDYHN.exe.bat NPUQ.exe File created C:\windows\SysWOW64\NVM.exe.bat VSIT.exe File opened for modification C:\windows\SysWOW64\SULW.exe VOF.exe File created C:\windows\SysWOW64\BUNBPB.exe.bat SULW.exe File created C:\windows\SysWOW64\ODGUT.exe.bat OXGG.exe File opened for modification C:\windows\SysWOW64\KWDKS.exe QIZ.exe File created C:\windows\SysWOW64\TQVH.exe KQT.exe File opened for modification C:\windows\SysWOW64\YPDA.exe SUE.exe File created C:\windows\SysWOW64\QBQQXKE.exe.bat YYMMS.exe File opened for modification C:\windows\SysWOW64\WTZCD.exe MSXX.exe File created C:\windows\SysWOW64\GOHIHX.exe WQTOAOO.exe File created C:\windows\SysWOW64\VSIT.exe JAN.exe File created C:\windows\SysWOW64\OXGG.exe.bat QAVDEH.exe File created C:\windows\SysWOW64\HASWT.exe.bat SXJ.exe File created C:\windows\SysWOW64\ALOSCQ.exe.bat DLHE.exe File opened for modification C:\windows\SysWOW64\BUNBPB.exe SULW.exe File created C:\windows\SysWOW64\NQOQR.exe.bat YVF.exe File opened for modification C:\windows\SysWOW64\TQVH.exe KQT.exe File created C:\windows\SysWOW64\TQVH.exe.bat KQT.exe File created C:\windows\SysWOW64\LNHSU.exe RRC.exe File created C:\windows\SysWOW64\LRWTYNK.exe IYFDD.exe File opened for modification C:\windows\SysWOW64\PHYTIWT.exe GYEGWR.exe File opened for modification C:\windows\SysWOW64\QBQQXKE.exe YYMMS.exe File created C:\windows\SysWOW64\IUBP.exe KUTCPLF.exe File created C:\windows\SysWOW64\OXGG.exe QAVDEH.exe File opened for modification C:\windows\SysWOW64\OLR.exe MYMYTG.exe File created C:\windows\SysWOW64\OLR.exe.bat MYMYTG.exe File created C:\windows\SysWOW64\ALOSCQ.exe DLHE.exe File created C:\windows\SysWOW64\JAN.exe.bat PMIRGZ.exe File opened for modification C:\windows\SysWOW64\OXGG.exe QAVDEH.exe File created C:\windows\SysWOW64\UDOICUS.exe ODGUT.exe File created C:\windows\SysWOW64\SUE.exe.bat WOGCAS.exe File opened for modification C:\windows\SysWOW64\EPLOVZ.exe YPDA.exe File created C:\windows\SysWOW64\IDYHN.exe NPUQ.exe File created C:\windows\SysWOW64\GAU.exe.bat MNPZRP.exe File opened for modification C:\windows\SysWOW64\KIRNZJ.exe GSK.exe File created C:\windows\SysWOW64\YPDA.exe.bat SUE.exe File opened for modification C:\windows\SysWOW64\MGCLUW.exe EWTJG.exe File created C:\windows\SysWOW64\KIRNZJ.exe GSK.exe File opened for modification C:\windows\SysWOW64\GOHIHX.exe WQTOAOO.exe File created C:\windows\SysWOW64\BUNBPB.exe SULW.exe File created C:\windows\SysWOW64\YEHAZ.exe DQCR.exe File opened for modification C:\windows\SysWOW64\UDOICUS.exe ODGUT.exe File created C:\windows\SysWOW64\HAY.exe YNOFHHG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YTTM.exe OLR.exe File opened for modification C:\windows\system\NHQ.exe YEHAZ.exe File created C:\windows\QIZ.exe.bat KIRNZJ.exe File created C:\windows\system\QTDJRLN.exe.bat NGYAHL.exe File opened for modification C:\windows\system\DLHE.exe LKF.exe File created C:\windows\system\JRA.exe.bat SHJ.exe File opened for modification C:\windows\system\SEGJGMG.exe FJOBWDP.exe File created C:\windows\MYMYTG.exe YNE.exe File created C:\windows\WQTOAOO.exe HASWT.exe File opened for modification C:\windows\system\KIL.exe CCL.exe File created C:\windows\system\CRSPY.exe YBMHLJP.exe File created C:\windows\TEW.exe KVUNY.exe File created C:\windows\system\KWZYS.exe.bat ZEEG.exe File opened for modification C:\windows\FJOBWDP.exe 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe File created C:\windows\system\PGR.exe.bat HAY.exe File created C:\windows\NGYAHL.exe.bat PGR.exe File created C:\windows\system\QTDJRLN.exe NGYAHL.exe File created C:\windows\system\XGKOY.exe.bat SGCBPEE.exe File created C:\windows\CYXPU.exe LNHSU.exe File opened for modification C:\windows\IPKTXV.exe MSEWQ.exe File created C:\windows\WBXE.exe.bat QBQQXKE.exe File created C:\windows\CCIU.exe.bat FWK.exe File created C:\windows\MGR.exe.bat KIL.exe File created C:\windows\system\MSXX.exe SFSOPWU.exe File opened for modification C:\windows\system\MSXX.exe SFSOPWU.exe File opened for modification C:\windows\system\KUTCPLF.exe TMRXLF.exe File created C:\windows\system\EHSKW.exe NHQ.exe File created C:\windows\QIZ.exe KIRNZJ.exe File opened for modification C:\windows\system\KQT.exe EPLOVZ.exe File opened for modification C:\windows\FWK.exe UEHM.exe File created C:\windows\system\RXAPXQ.exe WCVG.exe File opened for modification C:\windows\UFPZ.exe FPOAUPT.exe File opened for modification C:\windows\system\CCL.exe WCDPJKL.exe File opened for modification C:\windows\system\EHACVM.exe NXKEOZ.exe File opened for modification C:\windows\BMQ.exe NBZJS.exe File created C:\windows\SXJ.exe QHD.exe File created C:\windows\CYXPU.exe.bat LNHSU.exe File opened for modification C:\windows\system\MNPZRP.exe WKG.exe File created C:\windows\GSK.exe.bat NXHJHBD.exe File created C:\windows\NULNYA.exe.bat CCIU.exe File created C:\windows\system\PGR.exe HAY.exe File created C:\windows\system\ZJTLRB.exe ZOPQ.exe File created C:\windows\system\ZJTLRB.exe.bat ZOPQ.exe File created C:\windows\SCVLNRN.exe IPKTXV.exe File created C:\windows\system\ZVVVJL.exe IUBP.exe File created C:\windows\system\FWM.exe.bat CJPUANN.exe File opened for modification C:\windows\system\SYHYPBK.exe ZVVVJL.exe File created C:\windows\LKF.exe RXAPXQ.exe File created C:\windows\DQCR.exe.bat SYHYPBK.exe File opened for modification C:\windows\JMWFP.exe YTTM.exe File created C:\windows\system\NUD.exe.bat JMWFP.exe File created C:\windows\system\NPUQ.exe NKT.exe File opened for modification C:\windows\system\GYEGWR.exe JTZR.exe File created C:\windows\system\WCVG.exe.bat BOYWLRC.exe File created C:\windows\system\EHACVM.exe.bat NXKEOZ.exe File created C:\windows\EWTJG.exe.bat GAU.exe File created C:\windows\YSJPXLM.exe.bat DFEYN.exe File created C:\windows\system\GYEGWR.exe JTZR.exe File created C:\windows\system\WOGCAS.exe KWDKS.exe File created C:\windows\system\QHD.exe.bat QTDJRLN.exe File created C:\windows\system\KUTCPLF.exe.bat TMRXLF.exe File created C:\windows\system\CJPUANN.exe ALOSCQ.exe File opened for modification C:\windows\system\CJPUANN.exe ALOSCQ.exe File created C:\windows\system\ZOPQ.exe NVM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1196 cmd.exe 1568 cmd.exe 5404 cmd.exe 4260 cmd.exe 1064 cmd.exe 3712 cmd.exe 4580 cmd.exe 3512 cmd.exe 4620 cmd.exe 3024 cmd.exe 2404 cmd.exe 5724 cmd.exe 1564 cmd.exe 2760 cmd.exe 832 cmd.exe 3752 cmd.exe 4324 cmd.exe 5628 cmd.exe 5520 cmd.exe 1676 cmd.exe 2896 cmd.exe 4556 cmd.exe 204 cmd.exe 3892 cmd.exe 1968 cmd.exe 4072 cmd.exe 3416 cmd.exe 6044 cmd.exe 936 cmd.exe 3160 cmd.exe 4236 cmd.exe 4548 cmd.exe 5232 cmd.exe 5188 cmd.exe 5700 cmd.exe 2344 cmd.exe 2824 cmd.exe 3900 cmd.exe 3916 cmd.exe 1512 cmd.exe 4800 cmd.exe 5152 cmd.exe 4592 cmd.exe 2180 cmd.exe 5260 cmd.exe 4812 cmd.exe 908 cmd.exe 2308 cmd.exe 4900 cmd.exe 5056 cmd.exe 3228 cmd.exe 5856 cmd.exe 4932 cmd.exe 2628 cmd.exe 1776 cmd.exe 1232 cmd.exe 5860 cmd.exe 1688 cmd.exe 5876 cmd.exe 2316 cmd.exe 4712 cmd.exe 2000 cmd.exe 3700 cmd.exe 4572 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2260 1768 WerFault.exe 87 4764 4268 WerFault.exe 92 2388 2756 WerFault.exe 98 2232 3508 WerFault.exe 103 4864 5224 WerFault.exe 108 5068 4628 WerFault.exe 113 4556 1988 WerFault.exe 118 5784 1052 WerFault.exe 123 2092 2520 WerFault.exe 128 5504 2384 WerFault.exe 133 2420 4116 WerFault.exe 138 2548 4856 WerFault.exe 143 1680 2664 WerFault.exe 148 3488 1416 WerFault.exe 153 1720 3516 WerFault.exe 158 2892 1336 WerFault.exe 163 6080 1848 WerFault.exe 168 5596 248 WerFault.exe 173 3028 2200 WerFault.exe 178 940 5760 WerFault.exe 183 4844 4804 WerFault.exe 188 2108 4272 WerFault.exe 193 3528 6072 WerFault.exe 198 5616 5508 WerFault.exe 203 5528 2536 WerFault.exe 208 4832 2328 WerFault.exe 213 1508 1424 WerFault.exe 218 4280 4560 WerFault.exe 223 4168 3432 WerFault.exe 227 4956 3056 WerFault.exe 233 4108 2296 WerFault.exe 238 1244 2104 WerFault.exe 243 5736 1240 WerFault.exe 248 1140 2692 WerFault.exe 253 1172 2232 WerFault.exe 258 2464 5272 WerFault.exe 263 1020 5052 WerFault.exe 268 1388 2592 WerFault.exe 273 4588 4280 WerFault.exe 278 1016 5580 WerFault.exe 284 236 3924 WerFault.exe 289 4884 2420 WerFault.exe 294 4636 5228 WerFault.exe 299 2460 1872 WerFault.exe 304 5932 3152 WerFault.exe 309 4580 3140 WerFault.exe 314 6056 5980 WerFault.exe 319 5624 6080 WerFault.exe 324 3032 1532 WerFault.exe 329 2276 5012 WerFault.exe 334 4656 2588 WerFault.exe 339 5948 1892 WerFault.exe 344 1468 1272 WerFault.exe 349 5528 1184 WerFault.exe 354 3604 4892 WerFault.exe 359 4920 4148 WerFault.exe 364 1688 4944 WerFault.exe 369 2856 3164 WerFault.exe 374 2792 3092 WerFault.exe 379 5824 2652 WerFault.exe 384 5856 1244 WerFault.exe 389 2012 1352 WerFault.exe 394 828 5276 WerFault.exe 399 4104 3252 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFFYFQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXKEOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUNBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBVHPPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMBDXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYMMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTDJRLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPKTXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NULNYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBZJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIRNZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWDKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe 1768 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe 4268 FJOBWDP.exe 4268 FJOBWDP.exe 2756 SEGJGMG.exe 2756 SEGJGMG.exe 3508 FPOAUPT.exe 3508 FPOAUPT.exe 5224 UFPZ.exe 5224 UFPZ.exe 4628 YNE.exe 4628 YNE.exe 1988 MYMYTG.exe 1988 MYMYTG.exe 1052 OLR.exe 1052 OLR.exe 2520 YTTM.exe 2520 YTTM.exe 2384 JMWFP.exe 2384 JMWFP.exe 4116 NUD.exe 4116 NUD.exe 4856 NXHJHBD.exe 4856 NXHJHBD.exe 2664 GSK.exe 2664 GSK.exe 1416 KIRNZJ.exe 1416 KIRNZJ.exe 3516 QIZ.exe 3516 QIZ.exe 1336 KWDKS.exe 1336 KWDKS.exe 1848 WOGCAS.exe 1848 WOGCAS.exe 248 SUE.exe 248 SUE.exe 2200 YPDA.exe 2200 YPDA.exe 5760 EPLOVZ.exe 5760 EPLOVZ.exe 4804 KQT.exe 4804 KQT.exe 4272 TQVH.exe 4272 TQVH.exe 6072 ZQCVYTD.exe 6072 ZQCVYTD.exe 5508 UEHM.exe 5508 UEHM.exe 2536 FWK.exe 2536 FWK.exe 2328 CCIU.exe 2328 CCIU.exe 1424 NULNYA.exe 1424 NULNYA.exe 4560 YNOFHHG.exe 4560 YNOFHHG.exe 3432 HAY.exe 3432 HAY.exe 3056 PGR.exe 3056 PGR.exe 2296 NGYAHL.exe 2296 NGYAHL.exe 2104 QTDJRLN.exe 2104 QTDJRLN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1768 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe 1768 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe 4268 FJOBWDP.exe 4268 FJOBWDP.exe 2756 SEGJGMG.exe 2756 SEGJGMG.exe 3508 FPOAUPT.exe 3508 FPOAUPT.exe 5224 UFPZ.exe 5224 UFPZ.exe 4628 YNE.exe 4628 YNE.exe 1988 MYMYTG.exe 1988 MYMYTG.exe 1052 OLR.exe 1052 OLR.exe 2520 YTTM.exe 2520 YTTM.exe 2384 JMWFP.exe 2384 JMWFP.exe 4116 NUD.exe 4116 NUD.exe 4856 NXHJHBD.exe 4856 NXHJHBD.exe 2664 GSK.exe 2664 GSK.exe 1416 KIRNZJ.exe 1416 KIRNZJ.exe 3516 QIZ.exe 3516 QIZ.exe 1336 KWDKS.exe 1336 KWDKS.exe 1848 WOGCAS.exe 1848 WOGCAS.exe 248 SUE.exe 248 SUE.exe 2200 YPDA.exe 2200 YPDA.exe 5760 EPLOVZ.exe 5760 EPLOVZ.exe 4804 KQT.exe 4804 KQT.exe 4272 TQVH.exe 4272 TQVH.exe 6072 ZQCVYTD.exe 6072 ZQCVYTD.exe 5508 UEHM.exe 5508 UEHM.exe 2536 FWK.exe 2536 FWK.exe 2328 CCIU.exe 2328 CCIU.exe 1424 NULNYA.exe 1424 NULNYA.exe 4560 YNOFHHG.exe 4560 YNOFHHG.exe 3432 HAY.exe 3432 HAY.exe 3056 PGR.exe 3056 PGR.exe 2296 NGYAHL.exe 2296 NGYAHL.exe 2104 QTDJRLN.exe 2104 QTDJRLN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2504 1768 2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe 88 PID 2504 wrote to memory of 4268 2504 cmd.exe 92 PID 4268 wrote to memory of 5700 4268 FJOBWDP.exe 94 PID 5700 wrote to memory of 2756 5700 cmd.exe 98 PID 2756 wrote to memory of 3416 2756 SEGJGMG.exe 99 PID 3416 wrote to memory of 3508 3416 cmd.exe 103 PID 3508 wrote to memory of 5520 3508 FPOAUPT.exe 104 PID 5520 wrote to memory of 5224 5520 cmd.exe 108 PID 5224 wrote to memory of 3004 5224 UFPZ.exe 109 PID 3004 wrote to memory of 4628 3004 cmd.exe 113 PID 4628 wrote to memory of 1676 4628 YNE.exe 114 PID 1676 wrote to memory of 1988 1676 cmd.exe 118 PID 1988 wrote to memory of 4572 1988 MYMYTG.exe 119 PID 4572 wrote to memory of 1052 4572 cmd.exe 123 PID 1052 wrote to memory of 3576 1052 OLR.exe 124 PID 3576 wrote to memory of 2520 3576 cmd.exe 128 PID 2520 wrote to memory of 1348 2520 YTTM.exe 129 PID 1348 wrote to memory of 2384 1348 cmd.exe 133 PID 2384 wrote to memory of 4780 2384 JMWFP.exe 134 PID 4780 wrote to memory of 4116 4780 cmd.exe 138 PID 4116 wrote to memory of 3864 4116 NUD.exe 139 PID 3864 wrote to memory of 4856 3864 cmd.exe 143 PID 4856 wrote to memory of 2032 4856 NXHJHBD.exe 144 PID 2032 wrote to memory of 2664 2032 cmd.exe 148 PID 2664 wrote to memory of 4912 2664 GSK.exe 149 PID 4912 wrote to memory of 1416 4912 cmd.exe 153 PID 1416 wrote to memory of 5408 1416 KIRNZJ.exe 154 PID 5408 wrote to memory of 3516 5408 cmd.exe 158 PID 3516 wrote to memory of 2928 3516 QIZ.exe 159 PID 2928 wrote to memory of 1336 2928 cmd.exe 163 PID 1336 wrote to memory of 3408 1336 KWDKS.exe 164 PID 3408 wrote to memory of 1848 3408 cmd.exe 168 PID 1848 wrote to memory of 3240 1848 WOGCAS.exe 169 PID 3240 wrote to memory of 248 3240 cmd.exe 173 PID 248 wrote to memory of 4592 248 SUE.exe 174 PID 4592 wrote to memory of 2200 4592 cmd.exe 178 PID 2200 wrote to memory of 4836 2200 YPDA.exe 179 PID 4836 wrote to memory of 5760 4836 cmd.exe 183 PID 5760 wrote to memory of 2344 5760 EPLOVZ.exe 184 PID 2344 wrote to memory of 4804 2344 cmd.exe 188 PID 4804 wrote to memory of 2824 4804 KQT.exe 189 PID 2824 wrote to memory of 4272 2824 cmd.exe 193 PID 4272 wrote to memory of 1420 4272 TQVH.exe 194 PID 1420 wrote to memory of 6072 1420 cmd.exe 198 PID 6072 wrote to memory of 1800 6072 ZQCVYTD.exe 199 PID 1800 wrote to memory of 5508 1800 cmd.exe 203 PID 5508 wrote to memory of 1196 5508 UEHM.exe 204 PID 1196 wrote to memory of 2536 1196 cmd.exe 208 PID 2536 wrote to memory of 2740 2536 FWK.exe 209 PID 2740 wrote to memory of 2328 2740 cmd.exe 213 PID 2328 wrote to memory of 964 2328 CCIU.exe 214 PID 964 wrote to memory of 1424 964 cmd.exe 218 PID 1424 wrote to memory of 3752 1424 NULNYA.exe 219 PID 3752 wrote to memory of 4560 3752 cmd.exe 223 PID 4560 wrote to memory of 4224 4560 YNOFHHG.exe 224 PID 4224 wrote to memory of 3432 4224 cmd.exe 227 PID 3432 wrote to memory of 6044 3432 HAY.exe 229 PID 6044 wrote to memory of 3056 6044 cmd.exe 233 PID 3056 wrote to memory of 1568 3056 PGR.exe 234 PID 1568 wrote to memory of 2296 1568 cmd.exe 238 PID 2296 wrote to memory of 5348 2296 NGYAHL.exe 239 PID 5348 wrote to memory of 2104 5348 cmd.exe 243 PID 2104 wrote to memory of 5128 2104 QTDJRLN.exe 244 PID 5128 wrote to memory of 1240 5128 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_e63cf6d9222218227c8cd03c93d0b167_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJOBWDP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\windows\FJOBWDP.exeC:\windows\FJOBWDP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\YNE.exeC:\windows\system\YNE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\YTTM.exeC:\windows\YTTM.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\JMWFP.exeC:\windows\JMWFP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\NUD.exeC:\windows\system\NUD.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSK.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\GSK.exeC:\windows\GSK.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIRNZJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\SysWOW64\KIRNZJ.exeC:\windows\system32\KIRNZJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QIZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\QIZ.exeC:\windows\QIZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWDKS.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\KWDKS.exeC:\windows\system32\KWDKS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPLOVZ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\SysWOW64\EPLOVZ.exeC:\windows\system32\EPLOVZ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEHM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\SysWOW64\UEHM.exeC:\windows\system32\UEHM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\FWK.exeC:\windows\FWK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIU.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\windows\CCIU.exeC:\windows\CCIU.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NULNYA.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\windows\NULNYA.exeC:\windows\NULNYA.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNOFHHG.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\system\YNOFHHG.exeC:\windows\system\YNOFHHG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGR.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\system\PGR.exeC:\windows\system\PGR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTDJRLN.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\QTDJRLN.exeC:\windows\system\QTDJRLN.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXJ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2896 -
C:\windows\SXJ.exeC:\windows\SXJ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HASWT.exe.bat" "68⤵PID:1264
-
C:\windows\SysWOW64\HASWT.exeC:\windows\system32\HASWT.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQTOAOO.exe.bat" "70⤵PID:1188
-
C:\windows\WQTOAOO.exeC:\windows\WQTOAOO.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOHIHX.exe.bat" "72⤵
- Executes a command shell one-liner
PID:936 -
C:\windows\SysWOW64\GOHIHX.exeC:\windows\system32\GOHIHX.exe73⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGCBPEE.exe.bat" "74⤵PID:2672
-
C:\windows\system\SGCBPEE.exeC:\windows\system\SGCBPEE.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGKOY.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3160 -
C:\windows\system\XGKOY.exeC:\windows\system\XGKOY.exe77⤵
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "78⤵PID:2116
-
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCVG.exe.bat" "80⤵PID:4652
-
C:\windows\system\WCVG.exeC:\windows\system\WCVG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "82⤵PID:2016
-
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKF.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\windows\LKF.exeC:\windows\LKF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "86⤵PID:3080
-
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALOSCQ.exe.bat" "88⤵PID:1160
-
C:\windows\SysWOW64\ALOSCQ.exeC:\windows\system32\ALOSCQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CJPUANN.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1720 -
C:\windows\system\CJPUANN.exeC:\windows\system\CJPUANN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWM.exe.bat" "92⤵PID:5572
-
C:\windows\system\FWM.exeC:\windows\system\FWM.exe93⤵
- Executes dropped EXE
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMBDXF.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4556 -
C:\windows\JMBDXF.exeC:\windows\JMBDXF.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMIRGZ.exe.bat" "96⤵PID:4216
-
C:\windows\PMIRGZ.exeC:\windows\PMIRGZ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3024 -
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSIT.exe.bat" "100⤵PID:4964
-
C:\windows\SysWOW64\VSIT.exeC:\windows\system32\VSIT.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3900 -
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOPQ.exe.bat" "104⤵PID:4984
-
C:\windows\system\ZOPQ.exeC:\windows\system\ZOPQ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJTLRB.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5056 -
C:\windows\system\ZJTLRB.exeC:\windows\system\ZJTLRB.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMX.exe.bat" "108⤵PID:1408
-
C:\windows\SysWOW64\SMX.exeC:\windows\system32\SMX.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCDPJKL.exe.bat" "110⤵PID:5616
-
C:\windows\SysWOW64\WCDPJKL.exeC:\windows\system32\WCDPJKL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCL.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3228 -
C:\windows\system\CCL.exeC:\windows\system\CCL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "114⤵PID:3344
-
C:\windows\system\KIL.exeC:\windows\system\KIL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGR.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4236 -
C:\windows\MGR.exeC:\windows\MGR.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBVHPPA.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3168 -
C:\windows\SysWOW64\MBVHPPA.exeC:\windows\system32\MBVHPPA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOF.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4548 -
C:\windows\SysWOW64\VOF.exeC:\windows\system32\VOF.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-