Analysis
- max time kernel
88s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe
- Size 208KB
- Sample261006-vtkwcaff99
- SHA256 812f5f0099596dc95ee85d5b0760b6a34b5d4de3fba37ccb64e9f35480c2dcb6
- MD5 ad75a1c203d8a4be7db85ef3af255cf6
- SHA1 1c183fef08fd5a92a93a34e3b5bd6660dee25770
- SHA512 b0e58295e3349d55ddf0d7a50a452724af6ab8ec26d7527988da4352417c4cf99dc0f3ca615679247c3fdc6a51a05451f0a56a77e060f3045acae4e5a38c7e57
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfw4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO4QEj1
- TLSH T1DF247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3836 CWLXPA.exe 5668 AESBHY.exe 3888 HUTBO.exe 2508 RSZN.exe 3344 KVDRJS.exe 4408 MII.exe 5804 HWMK.exe 848 UGDIJCW.exe 5348 NJHEXS.exe 4500 OEK.exe 3864 MXNYLOD.exe 4360 HKSH.exe 828 GVD.exe 5500 KLJXI.exe 4436 ZGT.exe 3752 RJXFGXM.exe 2304 SEBB.exe 3168 ASNH.exe 988 PIOHDHG.exe 2532 IDSD.exe 3156 DOABXID.exe 2548 WREFCX.exe 1184 AZT.exe 2704 RHVK.exe 1172 GCEWLIL.exe 2488 QCGB.exe 5152 UTN.exe 5936 LTPH.exe 1768 UBRUIA.exe 692 ABQ.exe 4540 MUTA.exe 6072 ZFKRNNS.exe 2692 DNRZZ.exe 2012 UVT.exe 3732 YDZEP.exe 3620 TQENZVT.exe 4380 BEJCKTO.exe 2672 BZM.exe 3092 FPBYCB.exe 4272 QIWRCJT.exe 2428 AIY.exe 3324 UDDNQOS.exe 1180 GLJNC.exe 2328 BZOWMG.exe 1848 FPVF.exe 1528 OPXKC.exe 4556 AFEKOGH.exe 6052 ENKSA.exe 5624 IQI.exe 4440 OQQSJ.exe 4984 CWWQQEI.exe 1860 OMCQ.exe 1336 OSDEE.exe 5068 YPIY.exe 4328 TDNIWJ.exe 708 IYWU.exe 5860 GTWVT.exe 5328 BEM.exe 5648 LEOZLH.exe 4656 YPWP.exe 3364 PPYCD.exe 2316 ZXAH.exe 3560 FYIV.exe 5160 FBM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FPBYCB.exe BZM.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat BZM.exe File created C:\windows\SysWOW64\LUMPM.exe.bat RGI.exe File created C:\windows\SysWOW64\CWWQQEI.exe.bat OQQSJ.exe File created C:\windows\SysWOW64\LHYTW.exe.bat MWVDOA.exe File created C:\windows\SysWOW64\AYV.exe LDLPF.exe File opened for modification C:\windows\SysWOW64\HVLGZDT.exe HHTRQQQ.exe File created C:\windows\SysWOW64\XSANM.exe.bat TCUFILM.exe File opened for modification C:\windows\SysWOW64\BZM.exe BEJCKTO.exe File created C:\windows\SysWOW64\GTCSYA.exe.bat XSANM.exe File opened for modification C:\windows\SysWOW64\CWLXPA.exe 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe File created C:\windows\SysWOW64\CWLXPA.exe.bat 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe FPBYCB.exe File created C:\windows\SysWOW64\IQI.exe.bat ENKSA.exe File created C:\windows\SysWOW64\WTFVPMG.exe.bat GQVJ.exe File opened for modification C:\windows\SysWOW64\AYV.exe LDLPF.exe File opened for modification C:\windows\SysWOW64\OSDEE.exe OMCQ.exe File created C:\windows\SysWOW64\LEOZLH.exe BEM.exe File opened for modification C:\windows\SysWOW64\LHYTW.exe MWVDOA.exe File opened for modification C:\windows\SysWOW64\RGI.exe ELDGJC.exe File opened for modification C:\windows\SysWOW64\OHRZXX.exe LUMPM.exe File opened for modification C:\windows\SysWOW64\LEOZLH.exe BEM.exe File created C:\windows\SysWOW64\XSANM.exe TCUFILM.exe File created C:\windows\SysWOW64\KVDRJS.exe RSZN.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe RSZN.exe File created C:\windows\SysWOW64\RGI.exe.bat ELDGJC.exe File created C:\windows\SysWOW64\MII.exe KVDRJS.exe File created C:\windows\SysWOW64\MXNYLOD.exe OEK.exe File opened for modification C:\windows\SysWOW64\VOMW.exe GTCSYA.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat RSZN.exe File created C:\windows\SysWOW64\KLJXI.exe GVD.exe File created C:\windows\SysWOW64\CWWQQEI.exe OQQSJ.exe File created C:\windows\SysWOW64\OSDEE.exe OMCQ.exe File created C:\windows\SysWOW64\LBGMV.exe.bat WTFVPMG.exe File opened for modification C:\windows\SysWOW64\KLJXI.exe GVD.exe File created C:\windows\SysWOW64\QIWRCJT.exe FPBYCB.exe File opened for modification C:\windows\SysWOW64\YPWP.exe LEOZLH.exe File created C:\windows\SysWOW64\AYV.exe.bat LDLPF.exe File created C:\windows\SysWOW64\GUVJFY.exe.bat YPDUE.exe File opened for modification C:\windows\SysWOW64\HUTBO.exe AESBHY.exe File opened for modification C:\windows\SysWOW64\HKSH.exe MXNYLOD.exe File opened for modification C:\windows\SysWOW64\IQI.exe ENKSA.exe File opened for modification C:\windows\SysWOW64\TDNIWJ.exe YPIY.exe File opened for modification C:\windows\SysWOW64\GTCSYA.exe XSANM.exe File opened for modification C:\windows\SysWOW64\RHVK.exe AZT.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat FPBYCB.exe File created C:\windows\SysWOW64\PPYCD.exe.bat YPWP.exe File created C:\windows\SysWOW64\YPWP.exe.bat LEOZLH.exe File created C:\windows\SysWOW64\SKKD.exe.bat CHAYAL.exe File created C:\windows\SysWOW64\HVLGZDT.exe.bat HHTRQQQ.exe File created C:\windows\SysWOW64\AESBHY.exe CWLXPA.exe File opened for modification C:\windows\SysWOW64\AESBHY.exe CWLXPA.exe File created C:\windows\SysWOW64\HUTBO.exe.bat AESBHY.exe File opened for modification C:\windows\SysWOW64\FYIV.exe ZXAH.exe File created C:\windows\SysWOW64\OHRZXX.exe.bat LUMPM.exe File opened for modification C:\windows\SysWOW64\OEK.exe NJHEXS.exe File opened for modification C:\windows\SysWOW64\SEBB.exe RJXFGXM.exe File created C:\windows\SysWOW64\RHVK.exe.bat AZT.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe OQQSJ.exe File created C:\windows\SysWOW64\FYIV.exe.bat ZXAH.exe File created C:\windows\SysWOW64\VOMW.exe.bat GTCSYA.exe File created C:\windows\SysWOW64\HKSH.exe MXNYLOD.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe GQVJ.exe File created C:\windows\SysWOW64\OEK.exe NJHEXS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\RSZN.exe HUTBO.exe File created C:\windows\PIOHDHG.exe.bat ASNH.exe File opened for modification C:\windows\system\UDDNQOS.exe AIY.exe File created C:\windows\OMCQ.exe.bat CWWQQEI.exe File created C:\windows\system\GTWVT.exe IYWU.exe File created C:\windows\system\GROA.exe.bat GWLWGIS.exe File opened for modification C:\windows\system\ODCWLN.exe DKZDD.exe File opened for modification C:\windows\CKBCHV.exe VUADB.exe File created C:\windows\RSZN.exe HUTBO.exe File opened for modification C:\windows\system\UGDIJCW.exe HWMK.exe File opened for modification C:\windows\system\FPVF.exe BZOWMG.exe File opened for modification C:\windows\YPIY.exe OSDEE.exe File opened for modification C:\windows\IYWU.exe TDNIWJ.exe File created C:\windows\BEM.exe GTWVT.exe File created C:\windows\system\ZATCS.exe.bat SKKD.exe File created C:\windows\CKBCHV.exe VUADB.exe File created C:\windows\system\NJHEXS.exe UGDIJCW.exe File opened for modification C:\windows\MUTA.exe ABQ.exe File opened for modification C:\windows\OMCQ.exe CWWQQEI.exe File opened for modification C:\windows\ZXAH.exe PPYCD.exe File created C:\windows\XPT.exe OHRZXX.exe File opened for modification C:\windows\system\GROA.exe GWLWGIS.exe File created C:\windows\QPPVYL.exe MZI.exe File created C:\windows\BJLFNQB.exe VOMW.exe File created C:\windows\GVD.exe.bat HKSH.exe File created C:\windows\ASNH.exe.bat SEBB.exe File opened for modification C:\windows\system\KKKJ.exe GUVJFY.exe File created C:\windows\DUFV.exe.bat JHAMBQQ.exe File created C:\windows\OVW.exe CFI.exe File created C:\windows\HWMK.exe.bat MII.exe File created C:\windows\system\BZOWMG.exe.bat GLJNC.exe File opened for modification C:\windows\VUADB.exe AYV.exe File created C:\windows\VUADB.exe.bat AYV.exe File opened for modification C:\windows\system\CLU.exe CYBEN.exe File opened for modification C:\windows\system\XYZCR.exe CLU.exe File created C:\windows\system\TCUFILM.exe QPPVYL.exe File created C:\windows\system\ITNGH.exe PQKLCY.exe File opened for modification C:\windows\system\ZGT.exe KLJXI.exe File created C:\windows\PIOHDHG.exe ASNH.exe File created C:\windows\system\DKZDD.exe.bat MRWNCA.exe File opened for modification C:\windows\LDLPF.exe RQH.exe File created C:\windows\system\HHTRQQQ.exe CKBCHV.exe File opened for modification C:\windows\system\CYBEN.exe HVLGZDT.exe File created C:\windows\system\CLU.exe.bat CYBEN.exe File opened for modification C:\windows\PKRWAT.exe KKKJ.exe File created C:\windows\QCGB.exe.bat GCEWLIL.exe File opened for modification C:\windows\system\OPXKC.exe FPVF.exe File created C:\windows\system\CHAYAL.exe LHYTW.exe File created C:\windows\ELDGJC.exe QAN.exe File created C:\windows\system\HHTRQQQ.exe.bat CKBCHV.exe File created C:\windows\system\ITNGH.exe.bat PQKLCY.exe File created C:\windows\DGSQSWG.exe ITNGH.exe File created C:\windows\system\JHAMBQQ.exe DGSQSWG.exe File created C:\windows\system\GROA.exe GWLWGIS.exe File opened for modification C:\windows\system\MZI.exe DZGQI.exe File created C:\windows\PQKLCY.exe PKRWAT.exe File opened for modification C:\windows\system\DOABXID.exe IDSD.exe File created C:\windows\system\UBRUIA.exe LTPH.exe File created C:\windows\system\UVT.exe DNRZZ.exe File created C:\windows\ELDGJC.exe.bat QAN.exe File opened for modification C:\windows\OVW.exe CFI.exe File opened for modification C:\windows\system\GTWVT.exe IYWU.exe File opened for modification C:\windows\system\NJHEXS.exe UGDIJCW.exe File created C:\windows\system\ZGT.exe.bat KLJXI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2388 cmd.exe 2188 cmd.exe 3236 cmd.exe 1064 cmd.exe 5768 cmd.exe 3148 cmd.exe 3552 cmd.exe 5400 cmd.exe 1680 cmd.exe 4124 cmd.exe 2232 cmd.exe 1204 cmd.exe 5172 cmd.exe 3388 cmd.exe 5316 cmd.exe 4724 cmd.exe 3716 cmd.exe 2440 cmd.exe 5464 cmd.exe 4712 cmd.exe 5260 cmd.exe 964 cmd.exe 4452 cmd.exe 4784 cmd.exe 1796 cmd.exe 908 cmd.exe 2560 cmd.exe 1140 cmd.exe 456 cmd.exe 476 cmd.exe 2592 cmd.exe 2588 cmd.exe 4764 cmd.exe 4736 cmd.exe 3028 cmd.exe 2996 cmd.exe 5816 cmd.exe 1272 cmd.exe 4044 cmd.exe 4480 cmd.exe 3328 cmd.exe 1256 cmd.exe 4812 cmd.exe 3604 cmd.exe 4920 cmd.exe 5900 cmd.exe 5832 cmd.exe 1432 cmd.exe 5572 cmd.exe 1380 cmd.exe 1720 cmd.exe 2748 cmd.exe 2584 cmd.exe 3488 cmd.exe 2148 cmd.exe 2032 cmd.exe 5380 cmd.exe 4296 cmd.exe 4840 cmd.exe 4548 cmd.exe 1572 cmd.exe 3904 cmd.exe 2832 cmd.exe 2500 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2824 1832 WerFault.exe 87 3156 3836 WerFault.exe 92 5948 5668 WerFault.exe 98 2536 3888 WerFault.exe 103 2516 2508 WerFault.exe 108 800 3344 WerFault.exe 113 1508 4408 WerFault.exe 118 5596 5804 WerFault.exe 123 5860 848 WerFault.exe 128 1464 5348 WerFault.exe 133 5912 4500 WerFault.exe 138 1264 3864 WerFault.exe 143 1680 4360 WerFault.exe 148 5524 828 WerFault.exe 153 3252 5500 WerFault.exe 158 5052 4436 WerFault.exe 163 5360 3752 WerFault.exe 168 4420 2304 WerFault.exe 173 5688 3168 WerFault.exe 178 1708 988 WerFault.exe 183 2756 2532 WerFault.exe 188 5788 3156 WerFault.exe 193 5004 2548 WerFault.exe 198 2196 1184 WerFault.exe 203 5464 2704 WerFault.exe 208 2892 1172 WerFault.exe 213 248 2488 WerFault.exe 218 4512 5152 WerFault.exe 223 5664 5936 WerFault.exe 228 4876 1768 WerFault.exe 233 1812 692 WerFault.exe 238 1892 4540 WerFault.exe 243 3384 6072 WerFault.exe 248 2232 2692 WerFault.exe 253 3220 2012 WerFault.exe 258 4220 3732 WerFault.exe 263 3916 3620 WerFault.exe 268 4720 4380 WerFault.exe 274 5688 2672 WerFault.exe 279 4312 3092 WerFault.exe 284 1396 4272 WerFault.exe 289 1380 2428 WerFault.exe 294 1904 3324 WerFault.exe 299 1720 1180 WerFault.exe 304 2892 2328 WerFault.exe 309 5864 1848 WerFault.exe 314 752 1528 WerFault.exe 319 5116 4556 WerFault.exe 324 1776 6052 WerFault.exe 329 1076 5624 WerFault.exe 334 3204 4440 WerFault.exe 339 3792 4984 WerFault.exe 344 5508 1860 WerFault.exe 349 4092 1336 WerFault.exe 354 2956 5068 WerFault.exe 359 5928 4328 WerFault.exe 364 1092 708 WerFault.exe 369 5240 5860 WerFault.exe 374 1812 5328 WerFault.exe 379 1464 5648 WerFault.exe 384 4912 4656 WerFault.exe 389 5332 3364 WerFault.exe 394 2768 2316 WerFault.exe 399 2956 3560 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKBCHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELDGJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLGZDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYBEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITNGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHYTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUADB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSDEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSANM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBGMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPDUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGSQSWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWWQQEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIOHDHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBRUIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEOZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWLWGIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRWNCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJLFNQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQENZVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHAYAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQKLCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDDNQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCUFILM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKRWAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWVDOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe 1832 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe 3836 CWLXPA.exe 3836 CWLXPA.exe 5668 AESBHY.exe 5668 AESBHY.exe 3888 HUTBO.exe 3888 HUTBO.exe 2508 RSZN.exe 2508 RSZN.exe 3344 KVDRJS.exe 3344 KVDRJS.exe 4408 MII.exe 4408 MII.exe 5804 HWMK.exe 5804 HWMK.exe 848 UGDIJCW.exe 848 UGDIJCW.exe 5348 NJHEXS.exe 5348 NJHEXS.exe 4500 OEK.exe 4500 OEK.exe 3864 MXNYLOD.exe 3864 MXNYLOD.exe 4360 HKSH.exe 4360 HKSH.exe 828 GVD.exe 828 GVD.exe 5500 KLJXI.exe 5500 KLJXI.exe 4436 ZGT.exe 4436 ZGT.exe 3752 RJXFGXM.exe 3752 RJXFGXM.exe 2304 SEBB.exe 2304 SEBB.exe 3168 ASNH.exe 3168 ASNH.exe 988 PIOHDHG.exe 988 PIOHDHG.exe 2532 IDSD.exe 2532 IDSD.exe 3156 DOABXID.exe 3156 DOABXID.exe 2548 WREFCX.exe 2548 WREFCX.exe 1184 AZT.exe 1184 AZT.exe 2704 RHVK.exe 2704 RHVK.exe 1172 GCEWLIL.exe 1172 GCEWLIL.exe 2488 QCGB.exe 2488 QCGB.exe 5152 UTN.exe 5152 UTN.exe 5936 LTPH.exe 5936 LTPH.exe 1768 UBRUIA.exe 1768 UBRUIA.exe 692 ABQ.exe 692 ABQ.exe 4540 MUTA.exe 4540 MUTA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1832 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe 1832 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe 3836 CWLXPA.exe 3836 CWLXPA.exe 5668 AESBHY.exe 5668 AESBHY.exe 3888 HUTBO.exe 3888 HUTBO.exe 2508 RSZN.exe 2508 RSZN.exe 3344 KVDRJS.exe 3344 KVDRJS.exe 4408 MII.exe 4408 MII.exe 5804 HWMK.exe 5804 HWMK.exe 848 UGDIJCW.exe 848 UGDIJCW.exe 5348 NJHEXS.exe 5348 NJHEXS.exe 4500 OEK.exe 4500 OEK.exe 3864 MXNYLOD.exe 3864 MXNYLOD.exe 4360 HKSH.exe 4360 HKSH.exe 828 GVD.exe 828 GVD.exe 5500 KLJXI.exe 5500 KLJXI.exe 4436 ZGT.exe 4436 ZGT.exe 3752 RJXFGXM.exe 3752 RJXFGXM.exe 2304 SEBB.exe 2304 SEBB.exe 3168 ASNH.exe 3168 ASNH.exe 988 PIOHDHG.exe 988 PIOHDHG.exe 2532 IDSD.exe 2532 IDSD.exe 3156 DOABXID.exe 3156 DOABXID.exe 2548 WREFCX.exe 2548 WREFCX.exe 1184 AZT.exe 1184 AZT.exe 2704 RHVK.exe 2704 RHVK.exe 1172 GCEWLIL.exe 1172 GCEWLIL.exe 2488 QCGB.exe 2488 QCGB.exe 5152 UTN.exe 5152 UTN.exe 5936 LTPH.exe 5936 LTPH.exe 1768 UBRUIA.exe 1768 UBRUIA.exe 692 ABQ.exe 692 ABQ.exe 4540 MUTA.exe 4540 MUTA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2040 1832 2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe 88 PID 2040 wrote to memory of 3836 2040 cmd.exe 92 PID 3836 wrote to memory of 4548 3836 CWLXPA.exe 94 PID 4548 wrote to memory of 5668 4548 cmd.exe 98 PID 5668 wrote to memory of 1368 5668 AESBHY.exe 99 PID 1368 wrote to memory of 3888 1368 cmd.exe 103 PID 3888 wrote to memory of 1572 3888 HUTBO.exe 104 PID 1572 wrote to memory of 2508 1572 cmd.exe 108 PID 2508 wrote to memory of 5272 2508 RSZN.exe 109 PID 5272 wrote to memory of 3344 5272 cmd.exe 113 PID 3344 wrote to memory of 5636 3344 KVDRJS.exe 114 PID 5636 wrote to memory of 4408 5636 cmd.exe 118 PID 4408 wrote to memory of 4580 4408 MII.exe 119 PID 4580 wrote to memory of 5804 4580 cmd.exe 123 PID 5804 wrote to memory of 4588 5804 HWMK.exe 124 PID 4588 wrote to memory of 848 4588 cmd.exe 128 PID 848 wrote to memory of 1344 848 UGDIJCW.exe 129 PID 1344 wrote to memory of 5348 1344 cmd.exe 133 PID 5348 wrote to memory of 3924 5348 NJHEXS.exe 134 PID 3924 wrote to memory of 4500 3924 cmd.exe 138 PID 4500 wrote to memory of 4364 4500 OEK.exe 139 PID 4364 wrote to memory of 3864 4364 cmd.exe 143 PID 3864 wrote to memory of 1556 3864 MXNYLOD.exe 144 PID 1556 wrote to memory of 4360 1556 cmd.exe 148 PID 4360 wrote to memory of 4668 4360 HKSH.exe 149 PID 4668 wrote to memory of 828 4668 cmd.exe 153 PID 828 wrote to memory of 5380 828 GVD.exe 154 PID 5380 wrote to memory of 5500 5380 cmd.exe 158 PID 5500 wrote to memory of 1728 5500 KLJXI.exe 159 PID 1728 wrote to memory of 4436 1728 cmd.exe 163 PID 4436 wrote to memory of 5960 4436 ZGT.exe 164 PID 5960 wrote to memory of 3752 5960 cmd.exe 168 PID 3752 wrote to memory of 4344 3752 RJXFGXM.exe 169 PID 4344 wrote to memory of 2304 4344 cmd.exe 173 PID 2304 wrote to memory of 3432 2304 SEBB.exe 174 PID 3432 wrote to memory of 3168 3432 cmd.exe 178 PID 3168 wrote to memory of 4456 3168 ASNH.exe 179 PID 4456 wrote to memory of 988 4456 cmd.exe 183 PID 988 wrote to memory of 1912 988 PIOHDHG.exe 184 PID 1912 wrote to memory of 2532 1912 cmd.exe 188 PID 2532 wrote to memory of 1760 2532 IDSD.exe 189 PID 1760 wrote to memory of 3156 1760 cmd.exe 193 PID 3156 wrote to memory of 1244 3156 DOABXID.exe 194 PID 1244 wrote to memory of 2548 1244 cmd.exe 198 PID 2548 wrote to memory of 1468 2548 WREFCX.exe 199 PID 1468 wrote to memory of 1184 1468 cmd.exe 203 PID 1184 wrote to memory of 1272 1184 AZT.exe 204 PID 1272 wrote to memory of 2704 1272 cmd.exe 208 PID 2704 wrote to memory of 3552 2704 RHVK.exe 209 PID 3552 wrote to memory of 1172 3552 cmd.exe 213 PID 1172 wrote to memory of 476 1172 GCEWLIL.exe 214 PID 476 wrote to memory of 2488 476 cmd.exe 218 PID 2488 wrote to memory of 2188 2488 QCGB.exe 219 PID 2188 wrote to memory of 5152 2188 cmd.exe 223 PID 5152 wrote to memory of 5740 5152 UTN.exe 224 PID 5740 wrote to memory of 5936 5740 cmd.exe 228 PID 5936 wrote to memory of 1348 5936 LTPH.exe 229 PID 1348 wrote to memory of 1768 1348 cmd.exe 233 PID 1768 wrote to memory of 3492 1768 UBRUIA.exe 234 PID 3492 wrote to memory of 692 3492 cmd.exe 238 PID 692 wrote to memory of 1132 692 ABQ.exe 239 PID 1132 wrote to memory of 4540 1132 cmd.exe 243 PID 4540 wrote to memory of 4612 4540 MUTA.exe 244 PID 4612 wrote to memory of 6072 4612 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_ad75a1c203d8a4be7db85ef3af255cf6_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWLXPA.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\CWLXPA.exeC:\windows\system32\CWLXPA.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AESBHY.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\AESBHY.exeC:\windows\system32\AESBHY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSZN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\windows\RSZN.exeC:\windows\RSZN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MII.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\SysWOW64\MII.exeC:\windows\system32\MII.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWMK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\HWMK.exeC:\windows\HWMK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGDIJCW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\UGDIJCW.exeC:\windows\system\UGDIJCW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJHEXS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\system\NJHEXS.exeC:\windows\system\NJHEXS.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MXNYLOD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\MXNYLOD.exeC:\windows\system32\MXNYLOD.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\GVD.exeC:\windows\GVD.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASNH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\ASNH.exeC:\windows\ASNH.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIOHDHG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\PIOHDHG.exeC:\windows\PIOHDHG.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDSD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\IDSD.exeC:\windows\IDSD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOABXID.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\DOABXID.exeC:\windows\system\DOABXID.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\system\AZT.exeC:\windows\system\AZT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCGB.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\QCGB.exeC:\windows\QCGB.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTN.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\system\UTN.exeC:\windows\system\UTN.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTPH.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\SysWOW64\LTPH.exeC:\windows\system32\LTPH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBRUIA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\system\UBRUIA.exeC:\windows\system\UBRUIA.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABQ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\system\ABQ.exeC:\windows\system\ABQ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUTA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\MUTA.exeC:\windows\MUTA.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFKRNNS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\SysWOW64\ZFKRNNS.exeC:\windows\system32\ZFKRNNS.exe65⤵
- Executes dropped EXE
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNRZZ.exe.bat" "66⤵PID:4600
-
C:\windows\DNRZZ.exeC:\windows\DNRZZ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVT.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3696 -
C:\windows\system\UVT.exeC:\windows\system\UVT.exe69⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDZEP.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3328 -
C:\windows\YDZEP.exeC:\windows\YDZEP.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQENZVT.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5572 -
C:\windows\system\TQENZVT.exeC:\windows\system\TQENZVT.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEJCKTO.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2592 -
C:\windows\system\BEJCKTO.exeC:\windows\system\BEJCKTO.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZM.exe.bat" "76⤵PID:4340
-
C:\windows\SysWOW64\BZM.exeC:\windows\system32\BZM.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPBYCB.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1256 -
C:\windows\SysWOW64\FPBYCB.exeC:\windows\system32\FPBYCB.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIWRCJT.exe.bat" "80⤵PID:6044
-
C:\windows\SysWOW64\QIWRCJT.exeC:\windows\system32\QIWRCJT.exe81⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIY.exe.bat" "82⤵PID:940
-
C:\windows\AIY.exeC:\windows\AIY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLJNC.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2388 -
C:\windows\system\GLJNC.exeC:\windows\system\GLJNC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZOWMG.exe.bat" "88⤵PID:1332
-
C:\windows\system\BZOWMG.exeC:\windows\system\BZOWMG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPVF.exe.bat" "90⤵PID:4832
-
C:\windows\system\FPVF.exeC:\windows\system\FPVF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OPXKC.exe.bat" "92⤵PID:2080
-
C:\windows\system\OPXKC.exeC:\windows\system\OPXKC.exe93⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFEKOGH.exe.bat" "94⤵PID:1456
-
C:\windows\AFEKOGH.exeC:\windows\AFEKOGH.exe95⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENKSA.exe.bat" "96⤵PID:1576
-
C:\windows\ENKSA.exeC:\windows\ENKSA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQI.exe.bat" "98⤵PID:5340
-
C:\windows\SysWOW64\IQI.exeC:\windows\system32\IQI.exe99⤵
- Executes dropped EXE
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQQSJ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3904 -
C:\windows\OQQSJ.exeC:\windows\OQQSJ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWWQQEI.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4812 -
C:\windows\SysWOW64\CWWQQEI.exeC:\windows\system32\CWWQQEI.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMCQ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5400 -
C:\windows\OMCQ.exeC:\windows\OMCQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSDEE.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1680 -
C:\windows\SysWOW64\OSDEE.exeC:\windows\system32\OSDEE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPIY.exe.bat" "108⤵PID:2088
-
C:\windows\YPIY.exeC:\windows\YPIY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDNIWJ.exe.bat" "110⤵PID:2892
-
C:\windows\SysWOW64\TDNIWJ.exeC:\windows\system32\TDNIWJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYWU.exe.bat" "112⤵PID:1664
-
C:\windows\IYWU.exeC:\windows\IYWU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GTWVT.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3236 -
C:\windows\system\GTWVT.exeC:\windows\system\GTWVT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3668 -
C:\windows\BEM.exeC:\windows\BEM.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEOZLH.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2832 -
C:\windows\SysWOW64\LEOZLH.exeC:\windows\system32\LEOZLH.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPWP.exe.bat" "120⤵PID:2104
-
C:\windows\SysWOW64\YPWP.exeC:\windows\system32\YPWP.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-