Analysis
- max time kernel
78s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 12:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe
- Size 208KB
- Sample261003-pmkdcaybrf
- SHA256 2be83e0a65755e4b628d5002cdec53a70ca3190ed53f460384616a27b373d898
- MD5 55959355a11176f0f93c835f2cb75bd1
- SHA1 06a503e898af0042712ddcccb55dc973c060c183
- SHA512 1f5569729ed4ca641a23a31a82ee3800ca83689e011850c805b87e34c4dea245de99a51d2942cc3c086735f2fa5ad1229f52d67d818e568864b64f563c6baec6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfI4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOAkEj1
- TLSH T160247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2948 WERCW.exe 2788 SKLGHXF.exe 5360 LFPC.exe 2316 TTTQ.exe 3704 TWX.exe 4132 FOAFKQB.exe 824 IWHFXJ.exe 2800 DKM.exe 1076 USOB.exe 3332 YAUBXYB.exe 4268 RDYF.exe 5820 DLF.exe 2876 HBTFA.exe 936 ZEXJGPO.exe 4128 URCS.exe 928 FKXLY.exe 4528 RSM.exe 5108 RGE.exe 5356 XGLNVV.exe 2456 QBPRB.exe 4680 URWRNEI.exe 4632 LRY.exe 5472 RSFKH.exe 548 AAHXLBO.exe 4444 EIOX.exe 4056 QYVXJLY.exe 4076 UGJFOE.exe 3548 UMCTXJP.exe 4160 YCIT.exe 2412 KKXBOT.exe 5876 KPPQPYC.exe 3828 ELUZ.exe 1900 BIAOGI.exe 2252 FYG.exe 2548 ZLLGD.exe 1356 LEOZLH.exe 5836 FRL.exe 5952 JHZIA.exe 2652 VAUBIH.exe 1400 FYIV.exe 5728 PVO.exe 292 MWVDOA.exe 2808 PJANYAK.exe 4296 ACDF.exe 3688 CZJSOP.exe 5648 DCNVT.exe 5992 MDPBXL.exe 2616 MRIMUA.exe 4988 XJLFCHR.exe 3976 REPP.exe 5764 XFXCVC.exe 1728 JXAVE.exe 5560 FVYKLBZ.exe 6132 AIDU.exe 1220 GIKPEV.exe 4768 RBNAMCE.exe 932 TZHCLZ.exe 4884 LCKYY.exe 5496 IHQVF.exe 5368 ZNBNVVE.exe 4576 KFEG.exe 5872 ZLB.exe 4612 FGBEHP.exe 1932 AUF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QBPRB.exe.bat XGLNVV.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe KKXBOT.exe File created C:\windows\SysWOW64\XAKFLV.exe.bat RAC.exe File created C:\windows\SysWOW64\HKRUAD.exe.bat ORWBR.exe File created C:\windows\SysWOW64\JTH.exe.bat JFHLCNO.exe File created C:\windows\SysWOW64\CZJSOP.exe ACDF.exe File opened for modification C:\windows\SysWOW64\GUNBA.exe AUF.exe File opened for modification C:\windows\SysWOW64\FYLUAMZ.exe ZYDHRK.exe File created C:\windows\SysWOW64\WPWJHN.exe.bat HKRUAD.exe File created C:\windows\SysWOW64\OXEP.exe OSE.exe File created C:\windows\SysWOW64\JHZIA.exe FRL.exe File opened for modification C:\windows\SysWOW64\ACDF.exe PJANYAK.exe File created C:\windows\SysWOW64\XFXCVC.exe REPP.exe File created C:\windows\SysWOW64\GUNBA.exe AUF.exe File opened for modification C:\windows\SysWOW64\SMEFLM.exe MMW.exe File created C:\windows\SysWOW64\SMEFLM.exe.bat MMW.exe File opened for modification C:\windows\SysWOW64\SAWTUR.exe SMEFLM.exe File created C:\windows\SysWOW64\EGMJ.exe.bat JTH.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe FRL.exe File opened for modification C:\windows\SysWOW64\YIBHT.exe EVXX.exe File created C:\windows\SysWOW64\SAWTUR.exe SMEFLM.exe File opened for modification C:\windows\SysWOW64\HETW.exe ZZGQT.exe File created C:\windows\SysWOW64\KPPQPYC.exe KKXBOT.exe File created C:\windows\SysWOW64\XFXCVC.exe.bat REPP.exe File created C:\windows\SysWOW64\WPWJHN.exe HKRUAD.exe File created C:\windows\SysWOW64\WERCW.exe.bat 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe File created C:\windows\SysWOW64\QBPRB.exe XGLNVV.exe File created C:\windows\SysWOW64\KKXBOT.exe YCIT.exe File created C:\windows\SysWOW64\ELUZ.exe KPPQPYC.exe File created C:\windows\SysWOW64\FYLUAMZ.exe ZYDHRK.exe File opened for modification C:\windows\SysWOW64\AAHXLBO.exe RSFKH.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe YCIT.exe File opened for modification C:\windows\SysWOW64\ELUZ.exe KPPQPYC.exe File created C:\windows\SysWOW64\LEOZLH.exe ZLLGD.exe File created C:\windows\SysWOW64\PJANYAK.exe MWVDOA.exe File opened for modification C:\windows\SysWOW64\MDPBXL.exe DCNVT.exe File created C:\windows\SysWOW64\YIBHT.exe.bat EVXX.exe File created C:\windows\SysWOW64\SAWTUR.exe.bat SMEFLM.exe File created C:\windows\SysWOW64\PJANYAK.exe.bat MWVDOA.exe File created C:\windows\SysWOW64\MRIMUA.exe.bat MDPBXL.exe File opened for modification C:\windows\SysWOW64\XAKFLV.exe RAC.exe File opened for modification C:\windows\SysWOW64\EIOX.exe AAHXLBO.exe File created C:\windows\SysWOW64\LEOZLH.exe.bat ZLLGD.exe File opened for modification C:\windows\SysWOW64\FYIV.exe VAUBIH.exe File created C:\windows\SysWOW64\FYIV.exe.bat VAUBIH.exe File created C:\windows\SysWOW64\EGMJ.exe JTH.exe File opened for modification C:\windows\SysWOW64\WERCW.exe 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe File created C:\windows\SysWOW64\DLF.exe.bat RDYF.exe File opened for modification C:\windows\SysWOW64\XFXCVC.exe REPP.exe File opened for modification C:\windows\SysWOW64\EVXX.exe WPWJHN.exe File created C:\windows\SysWOW64\YIBHT.exe EVXX.exe File created C:\windows\SysWOW64\JTH.exe JFHLCNO.exe File created C:\windows\SysWOW64\QOSJASU.exe EGMJ.exe File opened for modification C:\windows\SysWOW64\QOSJASU.exe EGMJ.exe File created C:\windows\SysWOW64\DLF.exe RDYF.exe File created C:\windows\SysWOW64\FYIV.exe VAUBIH.exe File opened for modification C:\windows\SysWOW64\PJANYAK.exe MWVDOA.exe File created C:\windows\SysWOW64\ACDF.exe.bat PJANYAK.exe File opened for modification C:\windows\SysWOW64\MRIMUA.exe MDPBXL.exe File created C:\windows\SysWOW64\SMEFLM.exe MMW.exe File opened for modification C:\windows\SysWOW64\EGMJ.exe JTH.exe File created C:\windows\SysWOW64\OXEP.exe.bat OSE.exe File created C:\windows\SysWOW64\AAHXLBO.exe RSFKH.exe File created C:\windows\SysWOW64\AAHXLBO.exe.bat RSFKH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FRL.exe.bat LEOZLH.exe File opened for modification C:\windows\system\XJLFCHR.exe MRIMUA.exe File created C:\windows\system\LCKYY.exe TZHCLZ.exe File created C:\windows\ORWBR.exe.bat FELJ.exe File created C:\windows\OSE.exe.bat KKXA.exe File created C:\windows\KONCOFY.exe JSJYIP.exe File created C:\windows\system\USOB.exe DKM.exe File opened for modification C:\windows\system\RSM.exe FKXLY.exe File created C:\windows\XGLNVV.exe RGE.exe File created C:\windows\system\TZHCLZ.exe RBNAMCE.exe File created C:\windows\system\XMNYP.exe.bat TEGQDSF.exe File created C:\windows\system\JFHLCNO.exe SAWTUR.exe File created C:\windows\KKXA.exe QOSJASU.exe File opened for modification C:\windows\OSE.exe KKXA.exe File created C:\windows\system\LFPC.exe.bat SKLGHXF.exe File created C:\windows\system\DKM.exe IWHFXJ.exe File created C:\windows\URCS.exe ZEXJGPO.exe File opened for modification C:\windows\system\RGE.exe RSM.exe File created C:\windows\UGJFOE.exe QYVXJLY.exe File opened for modification C:\windows\system\LCKYY.exe TZHCLZ.exe File opened for modification C:\windows\system\IHQVF.exe LCKYY.exe File created C:\windows\FELJ.exe FYLUAMZ.exe File opened for modification C:\windows\AUF.exe FGBEHP.exe File opened for modification C:\windows\POUQX.exe KONCOFY.exe File opened for modification C:\windows\DZD.exe POUQX.exe File created C:\windows\system\ORGZ.exe.bat DZD.exe File created C:\windows\FYG.exe BIAOGI.exe File opened for modification C:\windows\DCNVT.exe CZJSOP.exe File created C:\windows\JXAVE.exe.bat XFXCVC.exe File created C:\windows\system\GHZYUMR.exe AHSKKJP.exe File created C:\windows\system\GHZYUMR.exe.bat AHSKKJP.exe File created C:\windows\KONCOFY.exe.bat JSJYIP.exe File created C:\windows\DZD.exe POUQX.exe File created C:\windows\GTZQ.exe RYPEPL.exe File opened for modification C:\windows\IWHFXJ.exe FOAFKQB.exe File created C:\windows\system\HBTFA.exe.bat DLF.exe File created C:\windows\XGLNVV.exe.bat RGE.exe File opened for modification C:\windows\REPP.exe XJLFCHR.exe File opened for modification C:\windows\system\FVYKLBZ.exe JXAVE.exe File opened for modification C:\windows\ZYDHRK.exe XAKFLV.exe File opened for modification C:\windows\system\ORGZ.exe DZD.exe File opened for modification C:\windows\system\DHHZANZ.exe ORGZ.exe File created C:\windows\system\USOB.exe.bat DKM.exe File opened for modification C:\windows\system\URWRNEI.exe QBPRB.exe File opened for modification C:\windows\FYG.exe BIAOGI.exe File opened for modification C:\windows\FRL.exe LEOZLH.exe File created C:\windows\MWVDOA.exe PVO.exe File created C:\windows\DCNVT.exe CZJSOP.exe File created C:\windows\system\RBNAMCE.exe.bat GIKPEV.exe File created C:\windows\AUF.exe FGBEHP.exe File created C:\windows\system\TWX.exe.bat TTTQ.exe File created C:\windows\system\HBTFA.exe DLF.exe File opened for modification C:\windows\system\RBNAMCE.exe GIKPEV.exe File opened for modification C:\windows\KKXA.exe QOSJASU.exe File created C:\windows\system\GWC.exe GTZQ.exe File opened for modification C:\windows\system\GWC.exe GTZQ.exe File created C:\windows\system\GWC.exe.bat GTZQ.exe File created C:\windows\RDYF.exe YAUBXYB.exe File created C:\windows\system\ZLLGD.exe.bat FYG.exe File opened for modification C:\windows\system\ZNBNVVE.exe IHQVF.exe File opened for modification C:\windows\system\KFEG.exe ZNBNVVE.exe File created C:\windows\RAC.exe GHZYUMR.exe File opened for modification C:\windows\RAC.exe GHZYUMR.exe File opened for modification C:\windows\system\ZZGQT.exe GWC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1644 cmd.exe 3156 cmd.exe 4840 cmd.exe 2400 cmd.exe 3004 cmd.exe 5112 cmd.exe 5468 cmd.exe 5256 cmd.exe 5168 cmd.exe 2636 cmd.exe 2764 cmd.exe 4228 cmd.exe 4940 cmd.exe 4272 cmd.exe 940 cmd.exe 2576 cmd.exe 4540 cmd.exe 752 cmd.exe 3176 cmd.exe 3996 cmd.exe 1152 cmd.exe 5396 cmd.exe 3436 cmd.exe 2892 cmd.exe 5488 cmd.exe 4828 cmd.exe 3296 cmd.exe 2888 cmd.exe 200 cmd.exe 3152 cmd.exe 2300 cmd.exe 1904 cmd.exe 1136 cmd.exe 3840 cmd.exe 2856 cmd.exe 3788 cmd.exe 4564 cmd.exe 2344 cmd.exe 3080 cmd.exe 1272 cmd.exe 4144 cmd.exe 4316 cmd.exe 1540 cmd.exe 2296 cmd.exe 856 cmd.exe 4904 cmd.exe 4588 cmd.exe 3944 cmd.exe 1412 cmd.exe 912 cmd.exe 5932 cmd.exe 1496 cmd.exe 3920 cmd.exe 4652 cmd.exe 4720 cmd.exe 2212 cmd.exe 1712 cmd.exe 3816 cmd.exe 4064 cmd.exe 1292 cmd.exe 5292 cmd.exe 4800 cmd.exe 4968 cmd.exe 4344 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1884 2580 WerFault.exe 86 3516 2948 WerFault.exe 91 3296 2788 WerFault.exe 98 4732 5360 WerFault.exe 103 2564 2316 WerFault.exe 108 4420 3704 WerFault.exe 113 3604 4132 WerFault.exe 118 4384 824 WerFault.exe 123 4592 2800 WerFault.exe 128 5144 1076 WerFault.exe 133 5368 3332 WerFault.exe 138 5600 4268 WerFault.exe 143 4032 5820 WerFault.exe 148 1216 2876 WerFault.exe 153 5924 936 WerFault.exe 158 3048 4128 WerFault.exe 163 1516 928 WerFault.exe 168 2888 4528 WerFault.exe 173 1400 5108 WerFault.exe 178 1812 5356 WerFault.exe 183 3104 2456 WerFault.exe 188 1212 4680 WerFault.exe 193 4104 4632 WerFault.exe 198 4800 5472 WerFault.exe 203 1920 548 WerFault.exe 208 1752 4444 WerFault.exe 213 3520 4056 WerFault.exe 218 2560 4076 WerFault.exe 223 1556 3548 WerFault.exe 228 2664 4160 WerFault.exe 233 4980 2412 WerFault.exe 238 5352 5876 WerFault.exe 243 4080 3828 WerFault.exe 248 4608 1900 WerFault.exe 253 2992 2252 WerFault.exe 258 3652 2548 WerFault.exe 263 5992 1356 WerFault.exe 268 6136 5836 WerFault.exe 273 1396 5952 WerFault.exe 278 2292 2652 WerFault.exe 284 3664 1400 WerFault.exe 289 3228 5728 WerFault.exe 294 4688 292 WerFault.exe 299 3144 2808 WerFault.exe 304 5412 4296 WerFault.exe 309 5136 3688 WerFault.exe 314 3464 5648 WerFault.exe 319 4852 5992 WerFault.exe 324 5692 2616 WerFault.exe 329 3424 4988 WerFault.exe 334 3432 3976 WerFault.exe 339 4108 5764 WerFault.exe 344 2380 1728 WerFault.exe 349 4844 5560 WerFault.exe 354 4360 6132 WerFault.exe 359 3912 1220 WerFault.exe 364 3012 4768 WerFault.exe 369 2732 932 WerFault.exe 374 2976 4884 WerFault.exe 379 4340 5496 WerFault.exe 384 3320 5368 WerFault.exe 389 4856 4576 WerFault.exe 394 1216 5872 WerFault.exe 399 4064 4612 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMEFLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POUQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAUBXYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFHLCNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGLNVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIAOGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMNYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEXJGPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKXLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRIMUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUTYTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBPRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDPBXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXAVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUNBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEOZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe 2580 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe 2948 WERCW.exe 2948 WERCW.exe 2788 SKLGHXF.exe 2788 SKLGHXF.exe 5360 LFPC.exe 5360 LFPC.exe 2316 TTTQ.exe 2316 TTTQ.exe 3704 TWX.exe 3704 TWX.exe 4132 FOAFKQB.exe 4132 FOAFKQB.exe 824 IWHFXJ.exe 824 IWHFXJ.exe 2800 DKM.exe 2800 DKM.exe 1076 USOB.exe 1076 USOB.exe 3332 YAUBXYB.exe 3332 YAUBXYB.exe 4268 RDYF.exe 4268 RDYF.exe 5820 DLF.exe 5820 DLF.exe 2876 HBTFA.exe 2876 HBTFA.exe 936 ZEXJGPO.exe 936 ZEXJGPO.exe 4128 URCS.exe 4128 URCS.exe 928 FKXLY.exe 928 FKXLY.exe 4528 RSM.exe 4528 RSM.exe 5108 RGE.exe 5108 RGE.exe 5356 XGLNVV.exe 5356 XGLNVV.exe 2456 QBPRB.exe 2456 QBPRB.exe 4680 URWRNEI.exe 4680 URWRNEI.exe 4632 LRY.exe 4632 LRY.exe 5472 RSFKH.exe 5472 RSFKH.exe 548 AAHXLBO.exe 548 AAHXLBO.exe 4444 EIOX.exe 4444 EIOX.exe 4056 QYVXJLY.exe 4056 QYVXJLY.exe 4076 UGJFOE.exe 4076 UGJFOE.exe 3548 UMCTXJP.exe 3548 UMCTXJP.exe 4160 YCIT.exe 4160 YCIT.exe 2412 KKXBOT.exe 2412 KKXBOT.exe 5876 KPPQPYC.exe 5876 KPPQPYC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2580 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe 2580 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe 2948 WERCW.exe 2948 WERCW.exe 2788 SKLGHXF.exe 2788 SKLGHXF.exe 5360 LFPC.exe 5360 LFPC.exe 2316 TTTQ.exe 2316 TTTQ.exe 3704 TWX.exe 3704 TWX.exe 4132 FOAFKQB.exe 4132 FOAFKQB.exe 824 IWHFXJ.exe 824 IWHFXJ.exe 2800 DKM.exe 2800 DKM.exe 1076 USOB.exe 1076 USOB.exe 3332 YAUBXYB.exe 3332 YAUBXYB.exe 4268 RDYF.exe 4268 RDYF.exe 5820 DLF.exe 5820 DLF.exe 2876 HBTFA.exe 2876 HBTFA.exe 936 ZEXJGPO.exe 936 ZEXJGPO.exe 4128 URCS.exe 4128 URCS.exe 928 FKXLY.exe 928 FKXLY.exe 4528 RSM.exe 4528 RSM.exe 5108 RGE.exe 5108 RGE.exe 5356 XGLNVV.exe 5356 XGLNVV.exe 2456 QBPRB.exe 2456 QBPRB.exe 4680 URWRNEI.exe 4680 URWRNEI.exe 4632 LRY.exe 4632 LRY.exe 5472 RSFKH.exe 5472 RSFKH.exe 548 AAHXLBO.exe 548 AAHXLBO.exe 4444 EIOX.exe 4444 EIOX.exe 4056 QYVXJLY.exe 4056 QYVXJLY.exe 4076 UGJFOE.exe 4076 UGJFOE.exe 3548 UMCTXJP.exe 3548 UMCTXJP.exe 4160 YCIT.exe 4160 YCIT.exe 2412 KKXBOT.exe 2412 KKXBOT.exe 5876 KPPQPYC.exe 5876 KPPQPYC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2400 2580 2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe 88 PID 2400 wrote to memory of 2948 2400 cmd.exe 91 PID 2948 wrote to memory of 4472 2948 WERCW.exe 94 PID 4472 wrote to memory of 2788 4472 cmd.exe 98 PID 2788 wrote to memory of 1148 2788 SKLGHXF.exe 99 PID 1148 wrote to memory of 5360 1148 cmd.exe 103 PID 5360 wrote to memory of 3096 5360 LFPC.exe 104 PID 3096 wrote to memory of 2316 3096 cmd.exe 108 PID 2316 wrote to memory of 5400 2316 TTTQ.exe 109 PID 5400 wrote to memory of 3704 5400 cmd.exe 113 PID 3704 wrote to memory of 3052 3704 TWX.exe 114 PID 3052 wrote to memory of 4132 3052 cmd.exe 118 PID 4132 wrote to memory of 5928 4132 FOAFKQB.exe 119 PID 5928 wrote to memory of 824 5928 cmd.exe 123 PID 824 wrote to memory of 256 824 IWHFXJ.exe 124 PID 256 wrote to memory of 2800 256 cmd.exe 128 PID 2800 wrote to memory of 4500 2800 DKM.exe 129 PID 4500 wrote to memory of 1076 4500 cmd.exe 133 PID 1076 wrote to memory of 4008 1076 USOB.exe 134 PID 4008 wrote to memory of 3332 4008 cmd.exe 138 PID 3332 wrote to memory of 1604 3332 YAUBXYB.exe 139 PID 1604 wrote to memory of 4268 1604 cmd.exe 143 PID 4268 wrote to memory of 4244 4268 RDYF.exe 144 PID 4244 wrote to memory of 5820 4244 cmd.exe 148 PID 5820 wrote to memory of 4556 5820 DLF.exe 149 PID 4556 wrote to memory of 2876 4556 cmd.exe 153 PID 2876 wrote to memory of 4696 2876 HBTFA.exe 154 PID 4696 wrote to memory of 936 4696 cmd.exe 158 PID 936 wrote to memory of 5700 936 ZEXJGPO.exe 159 PID 5700 wrote to memory of 4128 5700 cmd.exe 163 PID 4128 wrote to memory of 5196 4128 URCS.exe 164 PID 5196 wrote to memory of 928 5196 cmd.exe 168 PID 928 wrote to memory of 3324 928 FKXLY.exe 169 PID 3324 wrote to memory of 4528 3324 cmd.exe 173 PID 4528 wrote to memory of 2040 4528 RSM.exe 174 PID 2040 wrote to memory of 5108 2040 cmd.exe 178 PID 5108 wrote to memory of 4392 5108 RGE.exe 179 PID 4392 wrote to memory of 5356 4392 cmd.exe 183 PID 5356 wrote to memory of 4228 5356 XGLNVV.exe 184 PID 4228 wrote to memory of 2456 4228 cmd.exe 188 PID 2456 wrote to memory of 4720 2456 QBPRB.exe 189 PID 4720 wrote to memory of 4680 4720 cmd.exe 193 PID 4680 wrote to memory of 5348 4680 URWRNEI.exe 194 PID 5348 wrote to memory of 4632 5348 cmd.exe 198 PID 4632 wrote to memory of 4864 4632 LRY.exe 199 PID 4864 wrote to memory of 5472 4864 cmd.exe 203 PID 5472 wrote to memory of 4588 5472 RSFKH.exe 204 PID 4588 wrote to memory of 548 4588 cmd.exe 208 PID 548 wrote to memory of 5512 548 AAHXLBO.exe 209 PID 5512 wrote to memory of 4444 5512 cmd.exe 213 PID 4444 wrote to memory of 3316 4444 EIOX.exe 214 PID 3316 wrote to memory of 4056 3316 cmd.exe 218 PID 4056 wrote to memory of 5656 4056 QYVXJLY.exe 219 PID 5656 wrote to memory of 4076 5656 cmd.exe 223 PID 4076 wrote to memory of 4712 4076 UGJFOE.exe 224 PID 4712 wrote to memory of 3548 4712 cmd.exe 228 PID 3548 wrote to memory of 6032 3548 UMCTXJP.exe 229 PID 6032 wrote to memory of 4160 6032 cmd.exe 233 PID 4160 wrote to memory of 3904 4160 YCIT.exe 234 PID 3904 wrote to memory of 2412 3904 cmd.exe 238 PID 2412 wrote to memory of 6056 2412 KKXBOT.exe 239 PID 6056 wrote to memory of 5876 6056 cmd.exe 243 PID 5876 wrote to memory of 2488 5876 KPPQPYC.exe 244 PID 2488 wrote to memory of 3828 2488 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_55959355a11176f0f93c835f2cb75bd1_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WERCW.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\WERCW.exeC:\windows\system32\WERCW.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKLGHXF.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\SKLGHXF.exeC:\windows\SKLGHXF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFPC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\LFPC.exeC:\windows\system\LFPC.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTTQ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\windows\TTTQ.exeC:\windows\TTTQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWHFXJ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\IWHFXJ.exeC:\windows\IWHFXJ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USOB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\system\USOB.exeC:\windows\system\USOB.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAUBXYB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\windows\system\YAUBXYB.exeC:\windows\system\YAUBXYB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\RDYF.exeC:\windows\RDYF.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\SysWOW64\DLF.exeC:\windows\system32\DLF.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBTFA.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\system\HBTFA.exeC:\windows\system\HBTFA.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEXJGPO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\ZEXJGPO.exeC:\windows\ZEXJGPO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URCS.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\URCS.exeC:\windows\URCS.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKXLY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\FKXLY.exeC:\windows\system\FKXLY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\system\RSM.exeC:\windows\system\RSM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGE.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\RGE.exeC:\windows\system\RGE.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGLNVV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\XGLNVV.exeC:\windows\XGLNVV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBPRB.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\SysWOW64\QBPRB.exeC:\windows\system32\QBPRB.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URWRNEI.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\system\URWRNEI.exeC:\windows\system\URWRNEI.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\LRY.exeC:\windows\system\LRY.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSFKH.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\system\RSFKH.exeC:\windows\system\RSFKH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EIOX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\SysWOW64\EIOX.exeC:\windows\system32\EIOX.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYVXJLY.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\system\QYVXJLY.exeC:\windows\system\QYVXJLY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGJFOE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\UGJFOE.exeC:\windows\UGJFOE.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UMCTXJP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\windows\system\UMCTXJP.exeC:\windows\system\UMCTXJP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCIT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\system\YCIT.exeC:\windows\system\YCIT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKXBOT.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\SysWOW64\KKXBOT.exeC:\windows\system32\KKXBOT.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPPQPYC.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\SysWOW64\KPPQPYC.exeC:\windows\system32\KPPQPYC.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELUZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\SysWOW64\ELUZ.exeC:\windows\system32\ELUZ.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIAOGI.exe.bat" "66⤵PID:3552
-
C:\windows\system\BIAOGI.exeC:\windows\system\BIAOGI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYG.exe.bat" "68⤵PID:2516
-
C:\windows\FYG.exeC:\windows\FYG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLLGD.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\windows\system\ZLLGD.exeC:\windows\system\ZLLGD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEOZLH.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3296 -
C:\windows\SysWOW64\LEOZLH.exeC:\windows\system32\LEOZLH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FRL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\windows\FRL.exeC:\windows\FRL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHZIA.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4344 -
C:\windows\SysWOW64\JHZIA.exeC:\windows\system32\JHZIA.exe77⤵
- Executes dropped EXE
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VAUBIH.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2888 -
C:\windows\VAUBIH.exeC:\windows\VAUBIH.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYIV.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\windows\SysWOW64\FYIV.exeC:\windows\system32\FYIV.exe81⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PVO.exe.bat" "82⤵PID:5504
-
C:\windows\PVO.exeC:\windows\PVO.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWVDOA.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3004 -
C:\windows\MWVDOA.exeC:\windows\MWVDOA.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJANYAK.exe.bat" "86⤵PID:1600
-
C:\windows\SysWOW64\PJANYAK.exeC:\windows\system32\PJANYAK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACDF.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3720 -
C:\windows\SysWOW64\ACDF.exeC:\windows\system32\ACDF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZJSOP.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\windows\SysWOW64\CZJSOP.exeC:\windows\system32\CZJSOP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCNVT.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3176 -
C:\windows\DCNVT.exeC:\windows\DCNVT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MDPBXL.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3944 -
C:\windows\SysWOW64\MDPBXL.exeC:\windows\system32\MDPBXL.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRIMUA.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\SysWOW64\MRIMUA.exeC:\windows\system32\MRIMUA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJLFCHR.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:200 -
C:\windows\system\XJLFCHR.exeC:\windows\system\XJLFCHR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REPP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\windows\REPP.exeC:\windows\REPP.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFXCVC.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3988 -
C:\windows\SysWOW64\XFXCVC.exeC:\windows\system32\XFXCVC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXAVE.exe.bat" "104⤵PID:2432
-
C:\windows\JXAVE.exeC:\windows\JXAVE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVYKLBZ.exe.bat" "106⤵PID:3008
-
C:\windows\system\FVYKLBZ.exeC:\windows\system\FVYKLBZ.exe107⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AIDU.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\windows\system\AIDU.exeC:\windows\system\AIDU.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIKPEV.exe.bat" "110⤵PID:1144
-
C:\windows\system\GIKPEV.exeC:\windows\system\GIKPEV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBNAMCE.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4968 -
C:\windows\system\RBNAMCE.exeC:\windows\system\RBNAMCE.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TZHCLZ.exe.bat" "114⤵PID:3464
-
C:\windows\system\TZHCLZ.exeC:\windows\system\TZHCLZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCKYY.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1412 -
C:\windows\system\LCKYY.exeC:\windows\system\LCKYY.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHQVF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5724 -
C:\windows\system\IHQVF.exeC:\windows\system\IHQVF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZNBNVVE.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5112 -
C:\windows\system\ZNBNVVE.exeC:\windows\system\ZNBNVVE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-