Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/10/2026, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe
- Size 448KB
- Sample261004-2sndeayfjg
- SHA256 e1f0d6e1154673ba9d0a99875d4500945a61ed862524362dcfc6bbcce636565f
- MD5 ecbd5433e8b943d83ce48058496a7484
- SHA1 f8d516e32679782ab19521c08dd99756fb19225a
- SHA512 a16773d429075962743a57d7e0efb8b52d4aba2874a97c9810504b381185663b37b1ac69dc9f679bf67f419d66e41d748173dd82447146475b4ccf69fda39cc6
- SSDEEP 6144:MlZtbLWIgd1LZ9oECZbxlUS+LOdkEjWbjcSbcY+CaQdaFOY4iGFYtR:OLWI09QZb6LOdkFbz+xt4vF
- TLSH T1C4A4BF12B6C1C072D8AF01328CE6C7A81BB5BD629F7152CB77D8774E9E721D28A35391
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4796 EMEK.exe 2448 VPX.exe 3216 JKNFMBP.exe 2476 XQVRV.exe 5744 STDQC.exe 2728 WJK.exe 2484 PMOTT.exe 4460 GMQ.exe 3420 KUWGR.exe 4276 TCYLVTK.exe 1636 UGC.exe 5416 NYRS.exe 5988 ILWCU.exe 2516 MBD.exe 712 SPCKLF.exe 4604 MKHUVFI.exe 3332 OINOC.exe 4352 YYSI.exe 4548 RBEEXM.exe 2120 DRLMBE.exe 6048 HZR.exe 5284 QHTR.exe 4572 FCDEKGO.exe 1884 JFBRK.exe 1648 YAK.exe 1480 VBUFHQI.exe 1772 BBCT.exe 612 SBEYTQ.exe 5580 LEHC.exe 3336 AZRGSBV.exe 1108 SITL.exe 3212 GNZ.exe 4848 WDAIJVO.exe 2972 LYJMU.exe 2528 HEPJJA.exe 5496 REJ.exe 2088 RHVK.exe 2424 MUEUL.exe 4844 DDGZPE.exe 6064 WYKUU.exe 4912 XBOYISX.exe 3400 KMEXOVS.exe 5460 GRKMDEU.exe 1504 BEPV.exe 708 CZT.exe 5856 AVK.exe 2452 PQBMIK.exe 3128 AIWXJZY.exe 5736 LBZQ.exe 3260 MEDTWW.exe 4888 QUK.exe 5672 LHODT.exe 400 QIWRCJT.exe 5908 LVBA.exe 5412 LBBOO.exe 3892 RBJCFYM.exe 4452 SEMGKO.exe 1300 MRRPUOK.exe 4952 XKMIVVZ.exe 5148 DKUW.exe 3848 SQATTZ.exe 3284 UDFCDZR.exe 5936 PQJM.exe 2136 TGQMSRU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\YYSI.exe OINOC.exe File created C:\windows\SysWOW64\DRLMBE.exe.bat RBEEXM.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe YAK.exe File created C:\windows\SysWOW64\KMEXOVS.exe XBOYISX.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat SEMGKO.exe File opened for modification C:\windows\SysWOW64\QUK.exe MEDTWW.exe File created C:\windows\SysWOW64\FCDEKGO.exe.bat QHTR.exe File created C:\windows\SysWOW64\JFBRK.exe FCDEKGO.exe File created C:\windows\SysWOW64\AIWXJZY.exe PQBMIK.exe File created C:\windows\SysWOW64\XKMIVVZ.exe MRRPUOK.exe File opened for modification C:\windows\SysWOW64\XNZ.exe VAUBIH.exe File opened for modification C:\windows\SysWOW64\FRVGPLT.exe LEYXF.exe File created C:\windows\SysWOW64\FRVGPLT.exe.bat LEYXF.exe File created C:\windows\SysWOW64\SPCKLF.exe MBD.exe File created C:\windows\SysWOW64\YAK.exe.bat JFBRK.exe File opened for modification C:\windows\SysWOW64\RHVK.exe REJ.exe File created C:\windows\SysWOW64\SEMGKO.exe.bat RBJCFYM.exe File created C:\windows\SysWOW64\LEYXF.exe.bat TEW.exe File opened for modification C:\windows\SysWOW64\XGSKAXA.exe RFKWQ.exe File opened for modification C:\windows\SysWOW64\LGKQ.exe HQDQIOV.exe File created C:\windows\SysWOW64\CSZIHXS.exe.bat AUGOAAK.exe File created C:\windows\SysWOW64\OINOC.exe MKHUVFI.exe File opened for modification C:\windows\SysWOW64\JFBRK.exe FCDEKGO.exe File opened for modification C:\windows\SysWOW64\BEPV.exe GRKMDEU.exe File created C:\windows\SysWOW64\LBZQ.exe.bat AIWXJZY.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe LHODT.exe File opened for modification C:\windows\SysWOW64\SEMGKO.exe RBJCFYM.exe File created C:\windows\SysWOW64\XNZ.exe VAUBIH.exe File created C:\windows\SysWOW64\AAEN.exe FMZ.exe File created C:\windows\SysWOW64\XQVRV.exe JKNFMBP.exe File opened for modification C:\windows\SysWOW64\MRRPUOK.exe SEMGKO.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe PUV.exe File created C:\windows\SysWOW64\FRVGPLT.exe LEYXF.exe File created C:\windows\SysWOW64\XGSKAXA.exe RFKWQ.exe File created C:\windows\SysWOW64\GGU.exe XGSKAXA.exe File opened for modification C:\windows\SysWOW64\GGU.exe XGSKAXA.exe File opened for modification C:\windows\SysWOW64\HQDQIOV.exe MDZHY.exe File created C:\windows\SysWOW64\VBUFHQI.exe YAK.exe File opened for modification C:\windows\SysWOW64\KMEXOVS.exe XBOYISX.exe File created C:\windows\SysWOW64\BEPV.exe GRKMDEU.exe File opened for modification C:\windows\SysWOW64\CSZIHXS.exe AUGOAAK.exe File created C:\windows\SysWOW64\SPCKLF.exe.bat MBD.exe File created C:\windows\SysWOW64\NYRS.exe UGC.exe File opened for modification C:\windows\SysWOW64\FCDEKGO.exe QHTR.exe File created C:\windows\SysWOW64\YAK.exe JFBRK.exe File created C:\windows\SysWOW64\SEMGKO.exe RBJCFYM.exe File created C:\windows\SysWOW64\MRRPUOK.exe SEMGKO.exe File created C:\windows\SysWOW64\XKMIVVZ.exe.bat MRRPUOK.exe File created C:\windows\SysWOW64\HQDQIOV.exe.bat MDZHY.exe File created C:\windows\SysWOW64\NYRS.exe.bat UGC.exe File created C:\windows\SysWOW64\JFBRK.exe.bat FCDEKGO.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat YAK.exe File created C:\windows\SysWOW64\JHZIA.exe PUV.exe File created C:\windows\SysWOW64\XNZ.exe.bat VAUBIH.exe File created C:\windows\SysWOW64\HJO.exe MWJLFGV.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe JKNFMBP.exe File created C:\windows\SysWOW64\DRLMBE.exe RBEEXM.exe File opened for modification C:\windows\SysWOW64\SPCKLF.exe MBD.exe File created C:\windows\SysWOW64\YYSI.exe.bat OINOC.exe File opened for modification C:\windows\SysWOW64\YAK.exe JFBRK.exe File created C:\windows\SysWOW64\RHVK.exe.bat REJ.exe File created C:\windows\SysWOW64\BEPV.exe.bat GRKMDEU.exe File opened for modification C:\windows\SysWOW64\LBZQ.exe AIWXJZY.exe File created C:\windows\SysWOW64\UDFCDZR.exe SQATTZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ZMYOK.exe NUV.exe File opened for modification C:\windows\VAUBIH.exe JHZIA.exe File created C:\windows\QEA.exe.bat GGU.exe File created C:\windows\system\JKNFMBP.exe VPX.exe File created C:\windows\system\KUWGR.exe.bat GMQ.exe File created C:\windows\LBBOO.exe.bat LVBA.exe File opened for modification C:\windows\system\DBSGPSR.exe PWMRI.exe File created C:\windows\AXIR.exe OFFYFQP.exe File created C:\windows\DUIWISJ.exe.bat OEHXB.exe File opened for modification C:\windows\system\NSWRQB.exe DUIWISJ.exe File opened for modification C:\windows\system\BBCT.exe VBUFHQI.exe File opened for modification C:\windows\system\LYJMU.exe WDAIJVO.exe File created C:\windows\system\RBJCFYM.exe.bat LBBOO.exe File created C:\windows\system\PUV.exe.bat DBSGPSR.exe File created C:\windows\AUGOAAK.exe.bat UCZAR.exe File created C:\windows\system\BBCT.exe.bat VBUFHQI.exe File opened for modification C:\windows\system\PQBMIK.exe AVK.exe File created C:\windows\system\NUV.exe.bat TGQMSRU.exe File opened for modification C:\windows\system\CWTEZ.exe HJO.exe File opened for modification C:\windows\RFKWQ.exe AXIR.exe File created C:\windows\system\QHTR.exe.bat HZR.exe File created C:\windows\REJ.exe.bat HEPJJA.exe File created C:\windows\system\PQBMIK.exe.bat AVK.exe File created C:\windows\system\DKUW.exe.bat XKMIVVZ.exe File created C:\windows\MTF.exe.bat XNZ.exe File created C:\windows\system\IRRPY.exe IMRA.exe File opened for modification C:\windows\JFEM.exe FXXMNGN.exe File created C:\windows\system\UCZAR.exe AHU.exe File created C:\windows\GMQ.exe PMOTT.exe File created C:\windows\system\BBCT.exe VBUFHQI.exe File opened for modification C:\windows\WDRYAB.exe HYLBT.exe File created C:\windows\FMZ.exe CWTEZ.exe File created C:\windows\system\QGSEEBS.exe LGKQ.exe File created C:\windows\REJ.exe HEPJJA.exe File created C:\windows\system\LHODT.exe.bat QUK.exe File created C:\windows\OEHXB.exe QEA.exe File opened for modification C:\windows\ILWCU.exe NYRS.exe File created C:\windows\system\HYLBT.exe QLBJDVK.exe File opened for modification C:\windows\CLLLK.exe VVKUDRX.exe File created C:\windows\system\TCYLVTK.exe KUWGR.exe File opened for modification C:\windows\system\NUV.exe TGQMSRU.exe File opened for modification C:\windows\AHU.exe QGSEEBS.exe File created C:\windows\system\RBEEXM.exe.bat YYSI.exe File created C:\windows\SITL.exe.bat AZRGSBV.exe File opened for modification C:\windows\system\DDGZPE.exe MUEUL.exe File created C:\windows\WYKUU.exe.bat DDGZPE.exe File opened for modification C:\windows\CZT.exe BEPV.exe File opened for modification C:\windows\system\TGQMSRU.exe PQJM.exe File created C:\windows\CZT.exe BEPV.exe File created C:\windows\system\MGTDP.exe OGMPGFN.exe File created C:\windows\system\WJK.exe STDQC.exe File opened for modification C:\windows\system\KUWGR.exe GMQ.exe File created C:\windows\ZMYOK.exe NUV.exe File created C:\windows\system\VXWZT.exe VSWL.exe File created C:\windows\MTF.exe XNZ.exe File created C:\windows\system\IMRA.exe MGTDP.exe File opened for modification C:\windows\system\MUEUL.exe RHVK.exe File created C:\windows\WDRYAB.exe.bat HYLBT.exe File opened for modification C:\windows\AUGOAAK.exe UCZAR.exe File created C:\windows\system\HEPJJA.exe.bat LYJMU.exe File created C:\windows\MWJLFGV.exe.bat MTF.exe File created C:\windows\EMEK.exe 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe File opened for modification C:\windows\system\STDQC.exe XQVRV.exe File created C:\windows\system\WJK.exe.bat STDQC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3864 cmd.exe 4184 cmd.exe 1516 cmd.exe 928 cmd.exe 5500 cmd.exe 3264 cmd.exe 1344 cmd.exe 3672 cmd.exe 4712 cmd.exe 5640 cmd.exe 4772 cmd.exe 4104 cmd.exe 5948 cmd.exe 5396 cmd.exe 6008 cmd.exe 5688 cmd.exe 1532 cmd.exe 852 cmd.exe 4960 cmd.exe 2132 cmd.exe 1368 cmd.exe 3188 cmd.exe 2384 cmd.exe 2036 cmd.exe 4824 cmd.exe 1628 cmd.exe 5792 cmd.exe 4304 cmd.exe 5232 cmd.exe 3280 cmd.exe 2852 cmd.exe 1220 cmd.exe 4128 cmd.exe 628 cmd.exe 5196 cmd.exe 3224 cmd.exe 6020 cmd.exe 5088 cmd.exe 2004 cmd.exe 1728 cmd.exe 468 cmd.exe 5104 cmd.exe 464 cmd.exe 3024 cmd.exe 5184 cmd.exe 700 cmd.exe 3512 cmd.exe 1552 cmd.exe 5212 cmd.exe 2900 cmd.exe 3028 cmd.exe 1720 cmd.exe 4728 cmd.exe 2288 cmd.exe 5972 cmd.exe 4364 cmd.exe 5564 cmd.exe 1548 cmd.exe 3392 cmd.exe 1080 cmd.exe 5848 cmd.exe 4212 cmd.exe 3788 cmd.exe 4500 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2696 4896 WerFault.exe 87 700 4796 WerFault.exe 93 1728 2448 WerFault.exe 99 1712 3216 WerFault.exe 104 544 2476 WerFault.exe 109 5636 5744 WerFault.exe 114 2868 2728 WerFault.exe 119 4568 2484 WerFault.exe 124 5192 4460 WerFault.exe 129 1368 3420 WerFault.exe 134 3100 4276 WerFault.exe 139 1284 1636 WerFault.exe 144 2136 5416 WerFault.exe 149 776 5988 WerFault.exe 154 524 2516 WerFault.exe 159 2532 712 WerFault.exe 164 4452 4604 WerFault.exe 169 3128 3332 WerFault.exe 174 3804 4352 WerFault.exe 179 4304 4548 WerFault.exe 184 2820 2120 WerFault.exe 189 8 6048 WerFault.exe 194 4520 5284 WerFault.exe 199 2752 4572 WerFault.exe 204 5668 1884 WerFault.exe 209 4496 1648 WerFault.exe 214 3276 1480 WerFault.exe 219 5664 1772 WerFault.exe 224 4320 612 WerFault.exe 229 5564 5580 WerFault.exe 234 2544 3336 WerFault.exe 239 4924 1108 WerFault.exe 244 1368 3212 WerFault.exe 249 2220 4848 WerFault.exe 254 3552 2972 WerFault.exe 259 2888 2528 WerFault.exe 264 4488 5496 WerFault.exe 269 5108 2088 WerFault.exe 274 468 2424 WerFault.exe 279 5072 4844 WerFault.exe 284 968 6064 WerFault.exe 289 2444 4912 WerFault.exe 294 1896 3400 WerFault.exe 299 744 5460 WerFault.exe 304 4640 1504 WerFault.exe 309 2936 708 WerFault.exe 314 2412 5856 WerFault.exe 319 1220 2452 WerFault.exe 324 4320 3128 WerFault.exe 329 1604 5736 WerFault.exe 334 2684 3260 WerFault.exe 339 3264 4888 WerFault.exe 344 3608 5672 WerFault.exe 349 5708 400 WerFault.exe 354 5124 5908 WerFault.exe 359 1384 5412 WerFault.exe 364 2788 3892 WerFault.exe 369 424 4452 WerFault.exe 374 3672 1300 WerFault.exe 379 1352 4952 WerFault.exe 384 4772 5148 WerFault.exe 389 5788 3848 WerFault.exe 394 3592 3284 WerFault.exe 399 5408 5936 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRCJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQATTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMOTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUIWISJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBSGPSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYJMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFKWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEHXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQBMIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBOYISX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMEXOVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDFCDZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGMPGFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDZHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYQVUEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUWGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDAIJVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYKUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDGZPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQVRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWJLFGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRVGPLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4896 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe 4896 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe 4796 EMEK.exe 4796 EMEK.exe 2448 VPX.exe 2448 VPX.exe 3216 JKNFMBP.exe 3216 JKNFMBP.exe 2476 XQVRV.exe 2476 XQVRV.exe 5744 STDQC.exe 5744 STDQC.exe 2728 WJK.exe 2728 WJK.exe 2484 PMOTT.exe 2484 PMOTT.exe 4460 GMQ.exe 4460 GMQ.exe 3420 KUWGR.exe 3420 KUWGR.exe 4276 TCYLVTK.exe 4276 TCYLVTK.exe 1636 UGC.exe 1636 UGC.exe 5416 NYRS.exe 5416 NYRS.exe 5988 ILWCU.exe 5988 ILWCU.exe 2516 MBD.exe 2516 MBD.exe 712 SPCKLF.exe 712 SPCKLF.exe 4604 MKHUVFI.exe 4604 MKHUVFI.exe 3332 OINOC.exe 3332 OINOC.exe 4352 YYSI.exe 4352 YYSI.exe 4548 RBEEXM.exe 4548 RBEEXM.exe 2120 DRLMBE.exe 2120 DRLMBE.exe 6048 HZR.exe 6048 HZR.exe 5284 QHTR.exe 5284 QHTR.exe 4572 FCDEKGO.exe 4572 FCDEKGO.exe 1884 JFBRK.exe 1884 JFBRK.exe 1648 YAK.exe 1648 YAK.exe 1480 VBUFHQI.exe 1480 VBUFHQI.exe 1772 BBCT.exe 1772 BBCT.exe 612 SBEYTQ.exe 612 SBEYTQ.exe 5580 LEHC.exe 5580 LEHC.exe 3336 AZRGSBV.exe 3336 AZRGSBV.exe 1108 SITL.exe 1108 SITL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4896 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe 4896 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe 4796 EMEK.exe 4796 EMEK.exe 2448 VPX.exe 2448 VPX.exe 3216 JKNFMBP.exe 3216 JKNFMBP.exe 2476 XQVRV.exe 2476 XQVRV.exe 5744 STDQC.exe 5744 STDQC.exe 2728 WJK.exe 2728 WJK.exe 2484 PMOTT.exe 2484 PMOTT.exe 4460 GMQ.exe 4460 GMQ.exe 3420 KUWGR.exe 3420 KUWGR.exe 4276 TCYLVTK.exe 4276 TCYLVTK.exe 1636 UGC.exe 1636 UGC.exe 5416 NYRS.exe 5416 NYRS.exe 5988 ILWCU.exe 5988 ILWCU.exe 2516 MBD.exe 2516 MBD.exe 712 SPCKLF.exe 712 SPCKLF.exe 4604 MKHUVFI.exe 4604 MKHUVFI.exe 3332 OINOC.exe 3332 OINOC.exe 4352 YYSI.exe 4352 YYSI.exe 4548 RBEEXM.exe 4548 RBEEXM.exe 2120 DRLMBE.exe 2120 DRLMBE.exe 6048 HZR.exe 6048 HZR.exe 5284 QHTR.exe 5284 QHTR.exe 4572 FCDEKGO.exe 4572 FCDEKGO.exe 1884 JFBRK.exe 1884 JFBRK.exe 1648 YAK.exe 1648 YAK.exe 1480 VBUFHQI.exe 1480 VBUFHQI.exe 1772 BBCT.exe 1772 BBCT.exe 612 SBEYTQ.exe 612 SBEYTQ.exe 5580 LEHC.exe 5580 LEHC.exe 3336 AZRGSBV.exe 3336 AZRGSBV.exe 1108 SITL.exe 1108 SITL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4336 4896 2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe 89 PID 4336 wrote to memory of 4796 4336 cmd.exe 93 PID 4796 wrote to memory of 2824 4796 EMEK.exe 95 PID 2824 wrote to memory of 2448 2824 cmd.exe 99 PID 2448 wrote to memory of 4484 2448 VPX.exe 100 PID 4484 wrote to memory of 3216 4484 cmd.exe 104 PID 3216 wrote to memory of 4960 3216 JKNFMBP.exe 105 PID 4960 wrote to memory of 2476 4960 cmd.exe 109 PID 2476 wrote to memory of 2288 2476 XQVRV.exe 110 PID 2288 wrote to memory of 5744 2288 cmd.exe 114 PID 5744 wrote to memory of 716 5744 STDQC.exe 115 PID 716 wrote to memory of 2728 716 cmd.exe 119 PID 2728 wrote to memory of 1628 2728 WJK.exe 120 PID 1628 wrote to memory of 2484 1628 cmd.exe 124 PID 2484 wrote to memory of 1832 2484 PMOTT.exe 125 PID 1832 wrote to memory of 4460 1832 cmd.exe 129 PID 4460 wrote to memory of 4644 4460 GMQ.exe 130 PID 4644 wrote to memory of 3420 4644 cmd.exe 134 PID 3420 wrote to memory of 2432 3420 KUWGR.exe 135 PID 2432 wrote to memory of 4276 2432 cmd.exe 139 PID 4276 wrote to memory of 6128 4276 TCYLVTK.exe 140 PID 6128 wrote to memory of 1636 6128 cmd.exe 144 PID 1636 wrote to memory of 5364 1636 UGC.exe 145 PID 5364 wrote to memory of 5416 5364 cmd.exe 149 PID 5416 wrote to memory of 2108 5416 NYRS.exe 150 PID 2108 wrote to memory of 5988 2108 cmd.exe 154 PID 5988 wrote to memory of 6024 5988 ILWCU.exe 155 PID 6024 wrote to memory of 2516 6024 cmd.exe 159 PID 2516 wrote to memory of 5748 2516 MBD.exe 160 PID 5748 wrote to memory of 712 5748 cmd.exe 164 PID 712 wrote to memory of 5872 712 SPCKLF.exe 165 PID 5872 wrote to memory of 4604 5872 cmd.exe 169 PID 4604 wrote to memory of 1280 4604 MKHUVFI.exe 170 PID 1280 wrote to memory of 3332 1280 cmd.exe 174 PID 3332 wrote to memory of 5188 3332 OINOC.exe 175 PID 5188 wrote to memory of 4352 5188 cmd.exe 179 PID 4352 wrote to memory of 3248 4352 YYSI.exe 180 PID 3248 wrote to memory of 4548 3248 cmd.exe 184 PID 4548 wrote to memory of 5932 4548 RBEEXM.exe 185 PID 5932 wrote to memory of 2120 5932 cmd.exe 189 PID 2120 wrote to memory of 5972 2120 DRLMBE.exe 190 PID 5972 wrote to memory of 6048 5972 cmd.exe 194 PID 6048 wrote to memory of 240 6048 HZR.exe 195 PID 240 wrote to memory of 5284 240 cmd.exe 199 PID 5284 wrote to memory of 4104 5284 QHTR.exe 200 PID 4104 wrote to memory of 4572 4104 cmd.exe 204 PID 4572 wrote to memory of 3444 4572 FCDEKGO.exe 205 PID 3444 wrote to memory of 1884 3444 cmd.exe 209 PID 1884 wrote to memory of 5948 1884 JFBRK.exe 210 PID 5948 wrote to memory of 1648 5948 cmd.exe 214 PID 1648 wrote to memory of 4824 1648 YAK.exe 215 PID 4824 wrote to memory of 1480 4824 cmd.exe 219 PID 1480 wrote to memory of 5088 1480 VBUFHQI.exe 220 PID 5088 wrote to memory of 1772 5088 cmd.exe 224 PID 1772 wrote to memory of 2132 1772 BBCT.exe 225 PID 2132 wrote to memory of 612 2132 cmd.exe 229 PID 612 wrote to memory of 3280 612 SBEYTQ.exe 230 PID 3280 wrote to memory of 5580 3280 cmd.exe 234 PID 5580 wrote to memory of 4176 5580 LEHC.exe 235 PID 4176 wrote to memory of 3336 4176 cmd.exe 239 PID 3336 wrote to memory of 2568 3336 AZRGSBV.exe 240 PID 2568 wrote to memory of 1108 2568 cmd.exe 244 PID 1108 wrote to memory of 1360 1108 SITL.exe 245 PID 1360 wrote to memory of 3212 1360 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-04_ecbd5433e8b943d83ce48058496a7484_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMEK.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\EMEK.exeC:\windows\EMEK.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\SysWOW64\VPX.exeC:\windows\system32\VPX.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNFMBP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\system\JKNFMBP.exeC:\windows\system\JKNFMBP.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMOTT.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\windows\PMOTT.exeC:\windows\PMOTT.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\GMQ.exeC:\windows\GMQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUWGR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\system\KUWGR.exeC:\windows\system\KUWGR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\MBD.exeC:\windows\MBD.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPCKLF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\SysWOW64\SPCKLF.exeC:\windows\system32\SPCKLF.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKHUVFI.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\MKHUVFI.exeC:\windows\MKHUVFI.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OINOC.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\SysWOW64\OINOC.exeC:\windows\system32\OINOC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYSI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\windows\SysWOW64\YYSI.exeC:\windows\system32\YYSI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRLMBE.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\SysWOW64\DRLMBE.exeC:\windows\system32\DRLMBE.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\windows\HZR.exeC:\windows\HZR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JFBRK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\JFBRK.exeC:\windows\system32\JFBRK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEHC.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\LEHC.exeC:\windows\LEHC.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZRGSBV.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SysWOW64\AZRGSBV.exeC:\windows\system32\AZRGSBV.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SITL.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\windows\SITL.exeC:\windows\SITL.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe65⤵
- Executes dropped EXE
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDAIJVO.exe.bat" "66⤵PID:4468
-
C:\windows\WDAIJVO.exeC:\windows\WDAIJVO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "68⤵PID:1156
-
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEPJJA.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1120 -
C:\windows\system\HEPJJA.exeC:\windows\system\HEPJJA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\windows\REJ.exeC:\windows\REJ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "74⤵PID:1112
-
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUEUL.exe.bat" "76⤵PID:5656
-
C:\windows\system\MUEUL.exeC:\windows\system\MUEUL.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "78⤵PID:4084
-
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4212 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBOYISX.exe.bat" "82⤵PID:3500
-
C:\windows\XBOYISX.exeC:\windows\XBOYISX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3788 -
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRKMDEU.exe.bat" "86⤵PID:1688
-
C:\windows\GRKMDEU.exeC:\windows\GRKMDEU.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEPV.exe.bat" "88⤵PID:4332
-
C:\windows\SysWOW64\BEPV.exeC:\windows\system32\BEPV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZT.exe.bat" "90⤵PID:2148
-
C:\windows\CZT.exeC:\windows\CZT.exe91⤵
- Executes dropped EXE
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVK.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:700 -
C:\windows\AVK.exeC:\windows\AVK.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "94⤵PID:4864
-
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "96⤵PID:3276
-
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LBZQ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2852 -
C:\windows\SysWOW64\LBZQ.exeC:\windows\system32\LBZQ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEDTWW.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3512 -
C:\windows\system\MEDTWW.exeC:\windows\system\MEDTWW.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUK.exe.bat" "102⤵
- Executes a command shell one-liner
PID:928 -
C:\windows\SysWOW64\QUK.exeC:\windows\system32\QUK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHODT.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1552 -
C:\windows\system\LHODT.exeC:\windows\system\LHODT.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5792 -
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVBA.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4364 -
C:\windows\system\LVBA.exeC:\windows\system\LVBA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBBOO.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5500 -
C:\windows\LBBOO.exeC:\windows\LBBOO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBJCFYM.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\windows\system\RBJCFYM.exeC:\windows\system\RBJCFYM.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MRRPUOK.exe.bat" "116⤵PID:1888
-
C:\windows\SysWOW64\MRRPUOK.exeC:\windows\system32\MRRPUOK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKMIVVZ.exe.bat" "118⤵PID:4464
-
C:\windows\SysWOW64\XKMIVVZ.exeC:\windows\system32\XKMIVVZ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKUW.exe.bat" "120⤵PID:3572
-
C:\windows\system\DKUW.exeC:\windows\system\DKUW.exe121⤵
- Executes dropped EXE
PID:5148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-