Analysis
- max time kernel
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe
- Size 208KB
- Sample261002-p2ereaxxe1
- SHA256 a32831bc78db52c4e1604c30e910b2dc2f9c6f4b111d3b3a4afd44424c66f915
- MD5 6b3b429daef2ee60b006fd6595c0abf9
- SHA1 51502c4a3b59d6517b8a3488c495b970cae8331d
- SHA512 4976e1e4f7ed260b7dc8bb1fae310ded6d5db4344954384348faf8c2445995fe69949e3864cc708b3ae416cb735533569c203aa7334aa56e339c76ca59d9dd91
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfd4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOFkEj1
- TLSH T1F8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4416 VVE.exe 2508 SRJGLH.exe 200 IWIEF.exe 5668 CRNWHYY.exe 3228 XFK.exe 4252 OFMKV.exe 6140 SVBKHOD.exe 2300 BVV.exe 564 RYMCDG.exe 2380 XMDD.exe 5360 MPVHTWE.exe 1472 GCAY.exe 4364 QCUDH.exe 436 QFFZMJE.exe 5776 JIJDSH.exe 1636 TGP.exe 2980 ZGWLQK.exe 4700 BECXY.exe 3284 CZOBLIA.exe 1724 UCSXRG.exe 4440 PQW.exe 5364 GYQT.exe 5748 PLBLU.exe 3464 ZBOY.exe 4104 JJQLFO.exe 6068 URX.exe 5516 UFPZ.exe 3780 KAHDMY.exe 4356 ENM.exe 4448 ZBQEY.exe 2248 ZOJ.exe 5540 BBNCK.exe 3428 JWXHD.exe 2416 YNYG.exe 3396 CDMGOL.exe 3008 DYQCT.exe 4956 OQLUCI.exe 6128 SGSC.exe 4240 YGZQXU.exe 4648 UEFFEE.exe 2076 FXIYMLD.exe 3016 RPD.exe 2156 XPLFE.exe 5440 LVRCL.exe 412 TBRQUS.exe 3840 ETMJUZG.exe 4188 ZORS.exe 3320 WMXPM.exe 4488 TMEDDD.exe 464 FCLDH.exe 2376 NSMDOR.exe 5640 GLP.exe 5784 BYUF.exe 4684 KMEXOVS.exe 5256 BMGC.exe 5964 BEPV.exe 2948 BKHK.exe 2536 MDKDPY.exe 1244 WAQXE.exe 4256 CBXLNBD.exe 4520 IBF.exe 2688 ZMD.exe 3268 XCORRD.exe 2488 SXT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GCAY.exe MPVHTWE.exe File created C:\windows\SysWOW64\JIJDSH.exe.bat QFFZMJE.exe File created C:\windows\SysWOW64\ZGWLQK.exe.bat TGP.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe ZBOY.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat WMXPM.exe File created C:\windows\SysWOW64\WAQXE.exe.bat MDKDPY.exe File created C:\windows\SysWOW64\ZIFASQT.exe.bat QHDN.exe File created C:\windows\SysWOW64\BYUF.exe.bat GLP.exe File created C:\windows\SysWOW64\BECXY.exe ZGWLQK.exe File created C:\windows\SysWOW64\JJQLFO.exe ZBOY.exe File created C:\windows\SysWOW64\FXIYMLD.exe UEFFEE.exe File created C:\windows\SysWOW64\YJCS.exe.bat SRVESD.exe File created C:\windows\SysWOW64\SVBKHOD.exe OFMKV.exe File created C:\windows\SysWOW64\BEPV.exe.bat BMGC.exe File created C:\windows\SysWOW64\IXETF.exe JMBDXF.exe File created C:\windows\SysWOW64\FYNT.exe.bat BQGTLJI.exe File created C:\windows\SysWOW64\JIJDSH.exe QFFZMJE.exe File created C:\windows\SysWOW64\TGP.exe JIJDSH.exe File created C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\TBRQUS.exe LVRCL.exe File opened for modification C:\windows\SysWOW64\WAQXE.exe MDKDPY.exe File created C:\windows\SysWOW64\FEFIY.exe.bat FYNT.exe File created C:\windows\SysWOW64\BECXY.exe.bat ZGWLQK.exe File created C:\windows\SysWOW64\FXIYMLD.exe.bat UEFFEE.exe File created C:\windows\SysWOW64\ALCZTEF.exe.bat SFX.exe File created C:\windows\SysWOW64\WZDLBKE.exe.bat BLYTR.exe File created C:\windows\SysWOW64\GKXBZC.exe EMJHRTZ.exe File created C:\windows\SysWOW64\SOV.exe.bat FEFIY.exe File created C:\windows\SysWOW64\TGP.exe.bat JIJDSH.exe File created C:\windows\SysWOW64\ZGWLQK.exe TGP.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe TBRQUS.exe File opened for modification C:\windows\SysWOW64\KMEXOVS.exe BYUF.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe SFX.exe File opened for modification C:\windows\SysWOW64\ZMI.exe WZDLBKE.exe File created C:\windows\SysWOW64\UARPJ.exe ZNM.exe File created C:\windows\SysWOW64\FYNT.exe BQGTLJI.exe File opened for modification C:\windows\SysWOW64\GLP.exe NSMDOR.exe File created C:\windows\SysWOW64\BYUF.exe GLP.exe File opened for modification C:\windows\SysWOW64\ZGWLQK.exe TGP.exe File created C:\windows\SysWOW64\KAHDMY.exe UFPZ.exe File created C:\windows\SysWOW64\ALCZTEF.exe SFX.exe File created C:\windows\SysWOW64\SOV.exe FEFIY.exe File opened for modification C:\windows\SysWOW64\XFK.exe CRNWHYY.exe File opened for modification C:\windows\SysWOW64\SVBKHOD.exe OFMKV.exe File created C:\windows\SysWOW64\GCAY.exe.bat MPVHTWE.exe File opened for modification C:\windows\SysWOW64\BYUF.exe GLP.exe File created C:\windows\SysWOW64\ZMI.exe WZDLBKE.exe File opened for modification C:\windows\SysWOW64\UARPJ.exe ZNM.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe WMXPM.exe File created C:\windows\SysWOW64\YJCS.exe SRVESD.exe File opened for modification C:\windows\SysWOW64\OQLUCI.exe DYQCT.exe File opened for modification C:\windows\SysWOW64\IXETF.exe JMBDXF.exe File created C:\windows\SysWOW64\ZNM.exe.bat ESIWWR.exe File opened for modification C:\windows\SysWOW64\UOEM.exe JVB.exe File created C:\windows\SysWOW64\WAQXE.exe MDKDPY.exe File created C:\windows\SysWOW64\UARPJ.exe.bat ZNM.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat BYUF.exe File created C:\windows\SysWOW64\GKXBZC.exe.bat EMJHRTZ.exe File opened for modification C:\windows\SysWOW64\VQXZ.exe NCWKDN.exe File created C:\windows\SysWOW64\XFK.exe.bat CRNWHYY.exe File opened for modification C:\windows\SysWOW64\JIJDSH.exe QFFZMJE.exe File opened for modification C:\windows\SysWOW64\BECXY.exe ZGWLQK.exe File created C:\windows\SysWOW64\ETMJUZG.exe TBRQUS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\JFKN.exe ZIFASQT.exe File opened for modification C:\windows\WMXPM.exe ZORS.exe File opened for modification C:\windows\XMDD.exe RYMCDG.exe File created C:\windows\XMDD.exe.bat RYMCDG.exe File opened for modification C:\windows\system\CZOBLIA.exe BECXY.exe File created C:\windows\CDMGOL.exe.bat YNYG.exe File created C:\windows\system\VIM.exe.bat IXETF.exe File created C:\windows\GYQT.exe.bat PQW.exe File created C:\windows\RGYZS.exe.bat OQS.exe File created C:\windows\WXJRLPA.exe.bat HHIS.exe File opened for modification C:\windows\system\JVB.exe UARPJ.exe File created C:\windows\system\HXDAKC.exe.bat DHX.exe File opened for modification C:\windows\ZXAH.exe VUCMGC.exe File created C:\windows\YWQVI.exe.bat NDN.exe File created C:\windows\system\MPVHTWE.exe.bat XMDD.exe File created C:\windows\UFPZ.exe URX.exe File created C:\windows\system\NSMDOR.exe FCLDH.exe File opened for modification C:\windows\system\GKN.exe CUZL.exe File created C:\windows\system\YNYG.exe.bat JWXHD.exe File created C:\windows\WXJRLPA.exe HHIS.exe File opened for modification C:\windows\system\ZORS.exe ETMJUZG.exe File created C:\windows\BMGC.exe KMEXOVS.exe File created C:\windows\CBXLNBD.exe.bat WAQXE.exe File created C:\windows\UCSXRG.exe.bat CZOBLIA.exe File created C:\windows\system\PQW.exe.bat UCSXRG.exe File created C:\windows\ENM.exe.bat KAHDMY.exe File created C:\windows\system\SGSC.exe OQLUCI.exe File created C:\windows\system\JFKN.exe.bat ZIFASQT.exe File opened for modification C:\windows\system\IWIEF.exe SRJGLH.exe File created C:\windows\system\QFFZMJE.exe.bat QCUDH.exe File opened for modification C:\windows\XPLFE.exe RPD.exe File opened for modification C:\windows\system\MDKDPY.exe BKHK.exe File opened for modification C:\windows\system\SFX.exe SCTP.exe File opened for modification C:\windows\OFMKV.exe XFK.exe File created C:\windows\system\ESIWWR.exe TZNEO.exe File opened for modification C:\windows\YHPFPP.exe FELJ.exe File created C:\windows\UCSXRG.exe CZOBLIA.exe File opened for modification C:\windows\system\XCORRD.exe ZMD.exe File created C:\windows\system\HHIS.exe.bat MTDJCBO.exe File opened for modification C:\windows\IVIB.exe TFHBM.exe File created C:\windows\system\SDWO.exe OVQO.exe File created C:\windows\TZNEO.exe ZMI.exe File opened for modification C:\windows\ZBOY.exe PLBLU.exe File created C:\windows\LVRCL.exe.bat XPLFE.exe File created C:\windows\system\DFHHSF.exe.bat ZXAH.exe File opened for modification C:\windows\FELJ.exe KRG.exe File opened for modification C:\windows\YPDUE.exe SOV.exe File opened for modification C:\windows\DYQCT.exe CDMGOL.exe File opened for modification C:\windows\system\CJPUANN.exe ALCZTEF.exe File created C:\windows\system\IWRLY.exe ITNHTX.exe File opened for modification C:\windows\system\TFHBM.exe YJCS.exe File created C:\windows\system\ZOJ.exe ZBQEY.exe File created C:\windows\SCTP.exe.bat SXT.exe File opened for modification C:\windows\DMTP.exe CJPUANN.exe File created C:\windows\system\WHH.exe IWRLY.exe File created C:\windows\ZXAH.exe VUCMGC.exe File opened for modification C:\windows\BLYTR.exe SDWO.exe File created C:\windows\system\EMJHRTZ.exe.bat UOEM.exe File created C:\windows\system\CRNWHYY.exe IWIEF.exe File opened for modification C:\windows\RYMCDG.exe BVV.exe File opened for modification C:\windows\system\CYCOFA.exe FFAMB.exe File created C:\windows\system\JVB.exe UARPJ.exe File created C:\windows\system\DZER.exe.bat TBZXW.exe File created C:\windows\system\CRNWHYY.exe.bat IWIEF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1512 cmd.exe 2956 cmd.exe 3168 cmd.exe 4692 cmd.exe 2280 cmd.exe 4776 cmd.exe 5948 cmd.exe 3416 cmd.exe 2008 cmd.exe 2576 cmd.exe 3224 cmd.exe 3972 cmd.exe 972 cmd.exe 2772 cmd.exe 2600 cmd.exe 1372 cmd.exe 2700 cmd.exe 4368 cmd.exe 2148 cmd.exe 5928 cmd.exe 1484 cmd.exe 1960 cmd.exe 2988 cmd.exe 4908 cmd.exe 4888 cmd.exe 3468 cmd.exe 2768 cmd.exe 1112 cmd.exe 4936 cmd.exe 616 cmd.exe 2268 cmd.exe 2384 cmd.exe 4424 cmd.exe 4108 cmd.exe 2872 cmd.exe 1772 cmd.exe 4224 cmd.exe 4584 cmd.exe 1352 cmd.exe 5744 cmd.exe 3484 cmd.exe 4380 cmd.exe 2640 cmd.exe 2528 cmd.exe 4168 cmd.exe 244 cmd.exe 3772 cmd.exe 4652 cmd.exe 2004 cmd.exe 5568 cmd.exe 5752 cmd.exe 3340 cmd.exe 692 cmd.exe 4992 cmd.exe 396 cmd.exe 5216 cmd.exe 5768 cmd.exe 1760 cmd.exe 4576 cmd.exe 3724 cmd.exe 5936 cmd.exe 876 cmd.exe 1252 cmd.exe 4492 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4288 3028 WerFault.exe 87 2516 4416 WerFault.exe 92 396 2508 WerFault.exe 99 1592 200 WerFault.exe 104 2320 5668 WerFault.exe 109 4404 3228 WerFault.exe 114 4564 4252 WerFault.exe 119 1100 6140 WerFault.exe 124 5784 2300 WerFault.exe 129 3120 564 WerFault.exe 134 4504 2380 WerFault.exe 139 2780 5360 WerFault.exe 144 2476 1472 WerFault.exe 149 3280 4364 WerFault.exe 154 876 436 WerFault.exe 159 4376 5776 WerFault.exe 164 3484 1636 WerFault.exe 169 2996 2980 WerFault.exe 174 4708 4700 WerFault.exe 179 3472 3284 WerFault.exe 184 4992 1724 WerFault.exe 189 1808 4440 WerFault.exe 194 4880 5364 WerFault.exe 199 4580 5748 WerFault.exe 204 3808 3464 WerFault.exe 209 2424 4104 WerFault.exe 214 2088 6068 WerFault.exe 219 5608 5516 WerFault.exe 224 2928 3780 WerFault.exe 229 1052 4356 WerFault.exe 234 1940 4448 WerFault.exe 239 3104 2248 WerFault.exe 244 5336 5540 WerFault.exe 249 4504 3428 WerFault.exe 254 2780 2416 WerFault.exe 259 2616 3396 WerFault.exe 264 1760 3008 WerFault.exe 269 2784 4956 WerFault.exe 274 4344 6128 WerFault.exe 279 2632 4240 WerFault.exe 284 3452 4648 WerFault.exe 289 696 2076 WerFault.exe 294 4492 3016 WerFault.exe 299 4652 2156 WerFault.exe 304 5768 5440 WerFault.exe 309 4912 412 WerFault.exe 314 1444 3840 WerFault.exe 319 3424 4188 WerFault.exe 324 5320 3320 WerFault.exe 329 5180 4488 WerFault.exe 334 4708 464 WerFault.exe 339 696 2376 WerFault.exe 344 2284 5640 WerFault.exe 349 6096 5784 WerFault.exe 354 5564 4684 WerFault.exe 359 3580 5256 WerFault.exe 364 3084 5964 WerFault.exe 369 6020 2948 WerFault.exe 374 5452 2536 WerFault.exe 379 5356 1244 WerFault.exe 384 3628 4256 WerFault.exe 389 2832 4520 WerFault.exe 394 5584 2688 WerFault.exe 399 2868 3268 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJPUANN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFMKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBNCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWRLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIYMLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKXBZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETMJUZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FELJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCWKDN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGYZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBZXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZDLBKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZOBLIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYCOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIFASQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQLUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFHBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYQCT.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe 3028 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe 4416 VVE.exe 4416 VVE.exe 2508 SRJGLH.exe 2508 SRJGLH.exe 200 IWIEF.exe 200 IWIEF.exe 5668 CRNWHYY.exe 5668 CRNWHYY.exe 3228 XFK.exe 3228 XFK.exe 4252 OFMKV.exe 4252 OFMKV.exe 6140 SVBKHOD.exe 6140 SVBKHOD.exe 2300 BVV.exe 2300 BVV.exe 564 RYMCDG.exe 564 RYMCDG.exe 2380 XMDD.exe 2380 XMDD.exe 5360 MPVHTWE.exe 5360 MPVHTWE.exe 1472 GCAY.exe 1472 GCAY.exe 4364 QCUDH.exe 4364 QCUDH.exe 436 QFFZMJE.exe 436 QFFZMJE.exe 5776 JIJDSH.exe 5776 JIJDSH.exe 1636 TGP.exe 1636 TGP.exe 2980 ZGWLQK.exe 2980 ZGWLQK.exe 4700 BECXY.exe 4700 BECXY.exe 3284 CZOBLIA.exe 3284 CZOBLIA.exe 1724 UCSXRG.exe 1724 UCSXRG.exe 4440 PQW.exe 4440 PQW.exe 5364 GYQT.exe 5364 GYQT.exe 5748 PLBLU.exe 5748 PLBLU.exe 3464 ZBOY.exe 3464 ZBOY.exe 4104 JJQLFO.exe 4104 JJQLFO.exe 6068 URX.exe 6068 URX.exe 5516 UFPZ.exe 5516 UFPZ.exe 3780 KAHDMY.exe 3780 KAHDMY.exe 4356 ENM.exe 4356 ENM.exe 4448 ZBQEY.exe 4448 ZBQEY.exe 2248 ZOJ.exe 2248 ZOJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3028 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe 3028 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe 4416 VVE.exe 4416 VVE.exe 2508 SRJGLH.exe 2508 SRJGLH.exe 200 IWIEF.exe 200 IWIEF.exe 5668 CRNWHYY.exe 5668 CRNWHYY.exe 3228 XFK.exe 3228 XFK.exe 4252 OFMKV.exe 4252 OFMKV.exe 6140 SVBKHOD.exe 6140 SVBKHOD.exe 2300 BVV.exe 2300 BVV.exe 564 RYMCDG.exe 564 RYMCDG.exe 2380 XMDD.exe 2380 XMDD.exe 5360 MPVHTWE.exe 5360 MPVHTWE.exe 1472 GCAY.exe 1472 GCAY.exe 4364 QCUDH.exe 4364 QCUDH.exe 436 QFFZMJE.exe 436 QFFZMJE.exe 5776 JIJDSH.exe 5776 JIJDSH.exe 1636 TGP.exe 1636 TGP.exe 2980 ZGWLQK.exe 2980 ZGWLQK.exe 4700 BECXY.exe 4700 BECXY.exe 3284 CZOBLIA.exe 3284 CZOBLIA.exe 1724 UCSXRG.exe 1724 UCSXRG.exe 4440 PQW.exe 4440 PQW.exe 5364 GYQT.exe 5364 GYQT.exe 5748 PLBLU.exe 5748 PLBLU.exe 3464 ZBOY.exe 3464 ZBOY.exe 4104 JJQLFO.exe 4104 JJQLFO.exe 6068 URX.exe 6068 URX.exe 5516 UFPZ.exe 5516 UFPZ.exe 3780 KAHDMY.exe 3780 KAHDMY.exe 4356 ENM.exe 4356 ENM.exe 4448 ZBQEY.exe 4448 ZBQEY.exe 2248 ZOJ.exe 2248 ZOJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4164 3028 2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe 89 PID 4164 wrote to memory of 4416 4164 cmd.exe 92 PID 4416 wrote to memory of 4400 4416 VVE.exe 95 PID 4400 wrote to memory of 2508 4400 cmd.exe 99 PID 2508 wrote to memory of 972 2508 SRJGLH.exe 100 PID 972 wrote to memory of 200 972 cmd.exe 104 PID 200 wrote to memory of 3964 200 IWIEF.exe 105 PID 3964 wrote to memory of 5668 3964 cmd.exe 109 PID 5668 wrote to memory of 1204 5668 CRNWHYY.exe 110 PID 1204 wrote to memory of 3228 1204 cmd.exe 114 PID 3228 wrote to memory of 4620 3228 XFK.exe 115 PID 4620 wrote to memory of 4252 4620 cmd.exe 119 PID 4252 wrote to memory of 1932 4252 OFMKV.exe 120 PID 1932 wrote to memory of 6140 1932 cmd.exe 124 PID 6140 wrote to memory of 4680 6140 SVBKHOD.exe 125 PID 4680 wrote to memory of 2300 4680 cmd.exe 129 PID 2300 wrote to memory of 4888 2300 BVV.exe 130 PID 4888 wrote to memory of 564 4888 cmd.exe 134 PID 564 wrote to memory of 5556 564 RYMCDG.exe 135 PID 5556 wrote to memory of 2380 5556 cmd.exe 139 PID 2380 wrote to memory of 3468 2380 XMDD.exe 140 PID 3468 wrote to memory of 5360 3468 cmd.exe 144 PID 5360 wrote to memory of 4368 5360 MPVHTWE.exe 145 PID 4368 wrote to memory of 1472 4368 cmd.exe 149 PID 1472 wrote to memory of 5092 1472 GCAY.exe 150 PID 5092 wrote to memory of 4364 5092 cmd.exe 154 PID 4364 wrote to memory of 2148 4364 QCUDH.exe 155 PID 2148 wrote to memory of 436 2148 cmd.exe 159 PID 436 wrote to memory of 3168 436 QFFZMJE.exe 160 PID 3168 wrote to memory of 5776 3168 cmd.exe 164 PID 5776 wrote to memory of 1160 5776 JIJDSH.exe 165 PID 1160 wrote to memory of 1636 1160 cmd.exe 169 PID 1636 wrote to memory of 2768 1636 TGP.exe 170 PID 2768 wrote to memory of 2980 2768 cmd.exe 174 PID 2980 wrote to memory of 1412 2980 ZGWLQK.exe 175 PID 1412 wrote to memory of 4700 1412 cmd.exe 179 PID 4700 wrote to memory of 5936 4700 BECXY.exe 180 PID 5936 wrote to memory of 3284 5936 cmd.exe 184 PID 3284 wrote to memory of 4360 3284 CZOBLIA.exe 185 PID 4360 wrote to memory of 1724 4360 cmd.exe 189 PID 1724 wrote to memory of 4340 1724 UCSXRG.exe 190 PID 4340 wrote to memory of 4440 4340 cmd.exe 194 PID 4440 wrote to memory of 4432 4440 PQW.exe 195 PID 4432 wrote to memory of 5364 4432 cmd.exe 199 PID 5364 wrote to memory of 3232 5364 GYQT.exe 200 PID 3232 wrote to memory of 5748 3232 cmd.exe 204 PID 5748 wrote to memory of 4324 5748 PLBLU.exe 205 PID 4324 wrote to memory of 3464 4324 cmd.exe 209 PID 3464 wrote to memory of 5104 3464 ZBOY.exe 210 PID 5104 wrote to memory of 4104 5104 cmd.exe 214 PID 4104 wrote to memory of 3608 4104 JJQLFO.exe 215 PID 3608 wrote to memory of 6068 3608 cmd.exe 219 PID 6068 wrote to memory of 2772 6068 URX.exe 220 PID 2772 wrote to memory of 5516 2772 cmd.exe 224 PID 5516 wrote to memory of 4332 5516 UFPZ.exe 225 PID 4332 wrote to memory of 3780 4332 cmd.exe 229 PID 3780 wrote to memory of 3484 3780 KAHDMY.exe 230 PID 3484 wrote to memory of 4356 3484 cmd.exe 234 PID 4356 wrote to memory of 2996 4356 ENM.exe 235 PID 2996 wrote to memory of 4448 2996 cmd.exe 239 PID 4448 wrote to memory of 5032 4448 ZBQEY.exe 240 PID 5032 wrote to memory of 2248 5032 cmd.exe 244 PID 2248 wrote to memory of 3472 2248 ZOJ.exe 245 PID 3472 wrote to memory of 5540 3472 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6b3b429daef2ee60b006fd6595c0abf9_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVE.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\VVE.exeC:\windows\system\VVE.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRJGLH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\SysWOW64\SRJGLH.exeC:\windows\system32\SRJGLH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWIEF.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972 -
C:\windows\system\IWIEF.exeC:\windows\system\IWIEF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRNWHYY.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\system\CRNWHYY.exeC:\windows\system\CRNWHYY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFMKV.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\OFMKV.exeC:\windows\OFMKV.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\SysWOW64\BVV.exeC:\windows\system32\BVV.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYMCDG.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\RYMCDG.exeC:\windows\RYMCDG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\XMDD.exeC:\windows\XMDD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPVHTWE.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\system\MPVHTWE.exeC:\windows\system\MPVHTWE.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\QCUDH.exeC:\windows\QCUDH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGP.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\SysWOW64\TGP.exeC:\windows\system32\TGP.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGWLQK.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\ZGWLQK.exeC:\windows\system32\ZGWLQK.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\GYQT.exeC:\windows\GYQT.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBOY.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\ZBOY.exeC:\windows\ZBOY.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\windows\system\URX.exeC:\windows\system\URX.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\ENM.exeC:\windows\ENM.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBQEY.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\system\ZBQEY.exeC:\windows\system\ZBQEY.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "66⤵PID:5848
-
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "68⤵PID:1808
-
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDMGOL.exe.bat" "70⤵PID:3264
-
C:\windows\CDMGOL.exeC:\windows\CDMGOL.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2008 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1112 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:248 -
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe77⤵
- Executes dropped EXE
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe79⤵
- Executes dropped EXE
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "80⤵PID:2684
-
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5928 -
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "84⤵PID:3308
-
C:\windows\system\RPD.exeC:\windows\system\RPD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPLFE.exe.bat" "86⤵PID:3104
-
C:\windows\XPLFE.exeC:\windows\XPLFE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4380 -
C:\windows\LVRCL.exeC:\windows\LVRCL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBRQUS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\windows\SysWOW64\TBRQUS.exeC:\windows\system32\TBRQUS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZORS.exe.bat" "94⤵PID:5820
-
C:\windows\system\ZORS.exeC:\windows\system\ZORS.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMXPM.exe.bat" "96⤵
- Executes a command shell one-liner
PID:876 -
C:\windows\WMXPM.exeC:\windows\WMXPM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "98⤵PID:5700
-
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe99⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCLDH.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2600 -
C:\windows\FCLDH.exeC:\windows\FCLDH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSMDOR.exe.bat" "102⤵PID:2112
-
C:\windows\system\NSMDOR.exeC:\windows\system\NSMDOR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLP.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4692 -
C:\windows\SysWOW64\GLP.exeC:\windows\system32\GLP.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2280 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3456 -
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "110⤵PID:2932
-
C:\windows\BMGC.exeC:\windows\BMGC.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEPV.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4424 -
C:\windows\SysWOW64\BEPV.exeC:\windows\system32\BEPV.exe113⤵
- Executes dropped EXE
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKHK.exe.bat" "114⤵PID:5196
-
C:\windows\BKHK.exeC:\windows\BKHK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MDKDPY.exe.bat" "116⤵PID:1880
-
C:\windows\system\MDKDPY.exeC:\windows\system\MDKDPY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAQXE.exe.bat" "118⤵PID:4960
-
C:\windows\SysWOW64\WAQXE.exeC:\windows\system32\WAQXE.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBXLNBD.exe.bat" "120⤵PID:2028
-
C:\windows\CBXLNBD.exeC:\windows\CBXLNBD.exe121⤵
- Executes dropped EXE
PID:4256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-