Analysis
- max time kernel
96s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe
- Size 208KB
- Sample261006-yn7ppses9s
- SHA256 794780fa222f400c9fce57c5bed6d35cd3c587e771346bedcc0fa8a16286463a
- MD5 8ca1b0211add9a3ee4c6d013b1d0cb0b
- SHA1 b71bfeaaf3a915faa1a5ce1ab0eea23d6137fecf
- SHA512 4e74db83bfe5121f4f330c92e7f2a13ad27fbc1b21578f0c6d3bb42b542147c7fa6e981ef3f29556516eabe564456b9716ab2b8af9a2f5bee3813d84e3ecd5bc
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf74pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOzkEj1
- TLSH T105247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1672 LXPXLM.exe 5872 JITM.exe 2392 ZYU.exe 2808 COAMS.exe 1984 BZDC.exe 1228 GEVRQ.exe 4844 YHZNWER.exe 3000 EUYVBHG.exe 4556 SFHMPSC.exe 6028 HVIL.exe 1420 LLO.exe 3872 KWZCI.exe 2496 OEGKV.exe 4304 DHPOGRX.exe 1616 UHRT.exe 3996 NLVXWE.exe 3476 HYAGHEY.exe 4336 CLFQ.exe 3504 XWNO.exe 5480 HWPTBM.exe 3916 BSUDLMZ.exe 5000 CNYY.exe 4716 LVA.exe 4244 YGQCQ.exe 4724 QGKPUPA.exe 4572 ZTUHJ.exe 1268 DWTUJFY.exe 5856 SRKHU.exe 5820 EHR.exe 1528 NITM.exe 4860 XQVRV.exe 3876 MLE.exe 3092 GYJNR.exe 1848 SREFRP.exe 4116 EHLF.exe 460 CUKGIC.exe 5136 RXBT.exe 984 MLYCDP.exe 3764 OYD.exe 3628 JLIVQ.exe 1000 XRNS.exe 3436 DMNTBBZ.exe 4232 YZRC.exe 3192 EAZQVD.exe 4792 NABVGBR.exe 5904 KGZSNKT.exe 4908 GLFP.exe 5936 VGOTFHW.exe 1100 QTTD.exe 5172 SRUF.exe 3468 YSCT.exe 4912 HAW.exe 3564 CNBHT.exe 5404 TNDUWB.exe 2452 SLWP.exe 3360 BMYUVL.exe 432 DJRWBA.exe 3748 HRYW.exe 2444 BNDGP.exe 2376 CIGK.exe 1036 LVRCL.exe 2928 OIWLVFC.exe 4360 MEVMA.exe 4512 WBAGHQA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WTFVPMG.exe QSXH.exe File created C:\windows\SysWOW64\JITM.exe.bat LXPXLM.exe File opened for modification C:\windows\SysWOW64\ZTUHJ.exe QGKPUPA.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe NITM.exe File created C:\windows\SysWOW64\XQVRV.exe.bat NITM.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe MLE.exe File created C:\windows\SysWOW64\EMF.exe.bat DJBF.exe File created C:\windows\SysWOW64\GGS.exe WTFVPMG.exe File created C:\windows\SysWOW64\HYAGHEY.exe.bat NLVXWE.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat JML.exe File opened for modification C:\windows\SysWOW64\ZXX.exe TKYYHYB.exe File created C:\windows\SysWOW64\DJBF.exe.bat BLI.exe File created C:\windows\SysWOW64\SCVVW.exe.bat QFCT.exe File opened for modification C:\windows\SysWOW64\CUKGIC.exe EHLF.exe File created C:\windows\SysWOW64\NEJX.exe.bat RGR.exe File opened for modification C:\windows\SysWOW64\THON.exe EMF.exe File created C:\windows\SysWOW64\OUTWFC.exe.bat THON.exe File created C:\windows\SysWOW64\GGS.exe.bat WTFVPMG.exe File created C:\windows\SysWOW64\BZDC.exe.bat COAMS.exe File opened for modification C:\windows\SysWOW64\HRYW.exe DJRWBA.exe File created C:\windows\SysWOW64\TKYYHYB.exe JML.exe File created C:\windows\SysWOW64\MKYSE.exe.bat GKQWU.exe File opened for modification C:\windows\SysWOW64\QFCT.exe VRXKOXX.exe File created C:\windows\SysWOW64\KFP.exe.bat XCHG.exe File opened for modification C:\windows\SysWOW64\GGS.exe WTFVPMG.exe File created C:\windows\SysWOW64\SCLFD.exe WBCDZ.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe MEVMA.exe File opened for modification C:\windows\SysWOW64\JITM.exe LXPXLM.exe File opened for modification C:\windows\SysWOW64\LLO.exe HVIL.exe File created C:\windows\SysWOW64\SRKHU.exe.bat DWTUJFY.exe File created C:\windows\SysWOW64\GYJNR.exe.bat MLE.exe File created C:\windows\SysWOW64\NABVGBR.exe.bat EAZQVD.exe File created C:\windows\SysWOW64\QPFQ.exe WBAGHQA.exe File opened for modification C:\windows\SysWOW64\NEJX.exe RGR.exe File created C:\windows\SysWOW64\ZYU.exe.bat JITM.exe File created C:\windows\SysWOW64\EUYVBHG.exe.bat YHZNWER.exe File created C:\windows\SysWOW64\HRYW.exe DJRWBA.exe File created C:\windows\SysWOW64\HRYW.exe.bat DJRWBA.exe File created C:\windows\SysWOW64\NEJX.exe RGR.exe File created C:\windows\SysWOW64\DJBF.exe BLI.exe File created C:\windows\SysWOW64\THON.exe EMF.exe File created C:\windows\SysWOW64\QFCT.exe VRXKOXX.exe File created C:\windows\SysWOW64\ZYU.exe JITM.exe File created C:\windows\SysWOW64\EUYVBHG.exe YHZNWER.exe File created C:\windows\SysWOW64\CUKGIC.exe EHLF.exe File created C:\windows\SysWOW64\OYD.exe MLYCDP.exe File created C:\windows\SysWOW64\QPFQ.exe.bat WBAGHQA.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe QPFQ.exe File created C:\windows\SysWOW64\QSXH.exe.bat EAUPF.exe File created C:\windows\SysWOW64\SCLFD.exe.bat WBCDZ.exe File created C:\windows\SysWOW64\HYAGHEY.exe NLVXWE.exe File created C:\windows\SysWOW64\RXBT.exe.bat CUKGIC.exe File opened for modification C:\windows\SysWOW64\SRUF.exe QTTD.exe File created C:\windows\SysWOW64\SRUF.exe.bat QTTD.exe File created C:\windows\SysWOW64\MKYSE.exe GKQWU.exe File opened for modification C:\windows\SysWOW64\MKYSE.exe GKQWU.exe File created C:\windows\SysWOW64\OUTWFC.exe THON.exe File created C:\windows\SysWOW64\QFCT.exe.bat VRXKOXX.exe File created C:\windows\SysWOW64\WBAGHQA.exe MEVMA.exe File created C:\windows\SysWOW64\BZDC.exe COAMS.exe File created C:\windows\SysWOW64\NABVGBR.exe EAZQVD.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe WBAGHQA.exe File opened for modification C:\windows\SysWOW64\OUTWFC.exe THON.exe File opened for modification C:\windows\SysWOW64\WTFVPMG.exe QSXH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JML.exe.bat OQGUIQ.exe File created C:\windows\ROD.exe.bat GVIV.exe File opened for modification C:\windows\system\YHZNWER.exe GEVRQ.exe File opened for modification C:\windows\OEGKV.exe KWZCI.exe File created C:\windows\system\LYWEV.exe GXPIMQS.exe File opened for modification C:\windows\ZYPCIUL.exe SIO.exe File created C:\windows\system\RGR.exe.bat ZYPCIUL.exe File opened for modification C:\windows\system\XCHG.exe CGCXXAR.exe File created C:\windows\GEVRQ.exe.bat BZDC.exe File created C:\windows\system\DWTUJFY.exe.bat ZTUHJ.exe File created C:\windows\system\MEVMA.exe.bat OIWLVFC.exe File created C:\windows\WBUV.exe.bat WYQRZVL.exe File created C:\windows\system\COAMS.exe.bat ZYU.exe File opened for modification C:\windows\system\SLWP.exe TNDUWB.exe File created C:\windows\system\PLYI.exe TGSKOGZ.exe File opened for modification C:\windows\system\WYQRZVL.exe BKMIW.exe File opened for modification C:\windows\SREFRP.exe GYJNR.exe File created C:\windows\system\SLWP.exe TNDUWB.exe File opened for modification C:\windows\system\CIGK.exe BNDGP.exe File created C:\windows\system\GXPIMQS.exe CHIIZ.exe File created C:\windows\system\SIO.exe XVJCZHZ.exe File created C:\windows\system\CHAYAL.exe ZZU.exe File created C:\windows\HVIL.exe SFHMPSC.exe File created C:\windows\QGKPUPA.exe YGQCQ.exe File opened for modification C:\windows\system\MLYCDP.exe RXBT.exe File created C:\windows\system\KWZCI.exe LLO.exe File opened for modification C:\windows\system\YZRC.exe DMNTBBZ.exe File created C:\windows\EAZQVD.exe.bat YZRC.exe File created C:\windows\system\DXIS.exe TZDXMY.exe File created C:\windows\NLVXWE.exe.bat UHRT.exe File opened for modification C:\windows\system\CLFQ.exe HYAGHEY.exe File created C:\windows\CNYY.exe.bat BSUDLMZ.exe File opened for modification C:\windows\YGQCQ.exe LVA.exe File created C:\windows\OQGUIQ.exe PGDEHCQ.exe File opened for modification C:\windows\system\WBCDZ.exe GGS.exe File created C:\windows\XWNO.exe.bat CLFQ.exe File created C:\windows\LVRCL.exe.bat CIGK.exe File opened for modification C:\windows\system\BLI.exe HXDBODI.exe File created C:\windows\TZDXMY.exe RCPLFQE.exe File created C:\windows\system\LXPXLM.exe 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe File created C:\windows\system\CLFQ.exe HYAGHEY.exe File created C:\windows\system\LVA.exe.bat CNYY.exe File created C:\windows\system\MLE.exe XQVRV.exe File opened for modification C:\windows\system\DXIS.exe TZDXMY.exe File created C:\windows\LGAST.exe.bat WBUV.exe File opened for modification C:\windows\XVJCZHZ.exe ZXX.exe File created C:\windows\PRQWF.exe PLYI.exe File created C:\windows\BLSJ.exe.bat MQAFHU.exe File created C:\windows\XWNO.exe CLFQ.exe File created C:\windows\CNYY.exe BSUDLMZ.exe File created C:\windows\system\BNDGP.exe.bat HRYW.exe File opened for modification C:\windows\system\SFHMPSC.exe EUYVBHG.exe File opened for modification C:\windows\system\MLE.exe XQVRV.exe File created C:\windows\system\SIO.exe.bat XVJCZHZ.exe File created C:\windows\system\VKE.exe CHAYAL.exe File created C:\windows\OEGKV.exe KWZCI.exe File created C:\windows\HAW.exe.bat YSCT.exe File created C:\windows\system\XCVB.exe.bat OUTWFC.exe File created C:\windows\NFKXFMY.exe.bat DXIS.exe File created C:\windows\system\XCHG.exe.bat CGCXXAR.exe File created C:\windows\system\YHZNWER.exe.bat GEVRQ.exe File created C:\windows\NLVXWE.exe UHRT.exe File created C:\windows\QGKPUPA.exe.bat YGQCQ.exe File created C:\windows\EAZQVD.exe YZRC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 684 cmd.exe 1552 cmd.exe 4292 cmd.exe 5320 cmd.exe 5788 cmd.exe 2432 cmd.exe 3376 cmd.exe 4692 cmd.exe 5332 cmd.exe 4468 cmd.exe 2644 cmd.exe 4372 cmd.exe 4612 cmd.exe 248 cmd.exe 2052 cmd.exe 1924 cmd.exe 5976 cmd.exe 1116 cmd.exe 4848 cmd.exe 4464 cmd.exe 4228 cmd.exe 4248 cmd.exe 4472 cmd.exe 2340 cmd.exe 3900 cmd.exe 1408 cmd.exe 2616 cmd.exe 5040 cmd.exe 4348 cmd.exe 1792 cmd.exe 5052 cmd.exe 4748 cmd.exe 4936 cmd.exe 3948 cmd.exe 2868 cmd.exe 4644 cmd.exe 5920 cmd.exe 3528 cmd.exe 4696 cmd.exe 4772 cmd.exe 4504 cmd.exe 5372 cmd.exe 3112 cmd.exe 1292 cmd.exe 4932 cmd.exe 1236 cmd.exe 1220 cmd.exe 5360 cmd.exe 2508 cmd.exe 5460 cmd.exe 4744 cmd.exe 2328 cmd.exe 1096 cmd.exe 1356 cmd.exe 1240 cmd.exe 4420 cmd.exe 2464 cmd.exe 2244 cmd.exe 3380 cmd.exe 356 cmd.exe 2800 cmd.exe 2696 cmd.exe 1996 cmd.exe 5520 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3812 4812 WerFault.exe 88 5452 1672 WerFault.exe 94 4268 5872 WerFault.exe 100 3360 2392 WerFault.exe 105 3216 2808 WerFault.exe 110 5988 1984 WerFault.exe 115 3628 1228 WerFault.exe 120 2684 4844 WerFault.exe 125 4140 3000 WerFault.exe 130 3060 4556 WerFault.exe 135 1952 6028 WerFault.exe 140 3380 1420 WerFault.exe 145 5512 3872 WerFault.exe 150 2800 2496 WerFault.exe 155 1644 4304 WerFault.exe 160 1116 1616 WerFault.exe 165 2372 3996 WerFault.exe 170 2388 3476 WerFault.exe 175 1964 4336 WerFault.exe 180 2332 3504 WerFault.exe 185 1052 5480 WerFault.exe 190 1320 3916 WerFault.exe 195 2060 5000 WerFault.exe 200 5512 4716 WerFault.exe 205 432 4244 WerFault.exe 210 3820 4724 WerFault.exe 215 2976 4572 WerFault.exe 220 1724 1268 WerFault.exe 225 2376 5856 WerFault.exe 230 4460 5820 WerFault.exe 235 4692 1528 WerFault.exe 240 4736 4860 WerFault.exe 245 5348 3876 WerFault.exe 250 4636 3092 WerFault.exe 255 3280 1848 WerFault.exe 260 4652 4116 WerFault.exe 265 1332 460 WerFault.exe 270 5956 5136 WerFault.exe 275 2752 984 WerFault.exe 280 5916 3764 WerFault.exe 285 1612 3628 WerFault.exe 290 2648 1000 WerFault.exe 295 6132 3436 WerFault.exe 300 4112 4232 WerFault.exe 305 3376 3192 WerFault.exe 310 3340 4792 WerFault.exe 315 4984 5904 WerFault.exe 320 4300 4908 WerFault.exe 325 3336 5936 WerFault.exe 330 2356 1100 WerFault.exe 335 3456 5172 WerFault.exe 340 1764 3468 WerFault.exe 345 4596 4912 WerFault.exe 350 1844 3564 WerFault.exe 355 1416 5404 WerFault.exe 360 248 2452 WerFault.exe 365 4712 3360 WerFault.exe 370 4804 432 WerFault.exe 375 6008 3748 WerFault.exe 380 1120 2444 WerFault.exe 385 4352 2376 WerFault.exe 390 5348 1036 WerFault.exe 395 1320 2928 WerFault.exe 400 1208 4360 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWPTBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNDUWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKYYHYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JITM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVJCZHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXDBODI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJRWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGSKOGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMNTBBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTUHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHZNWER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGPSCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYAGHEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVRCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTFVPMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZSLK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe 4812 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe 1672 LXPXLM.exe 1672 LXPXLM.exe 5872 JITM.exe 5872 JITM.exe 2392 ZYU.exe 2392 ZYU.exe 2808 COAMS.exe 2808 COAMS.exe 1984 BZDC.exe 1984 BZDC.exe 1228 GEVRQ.exe 1228 GEVRQ.exe 4844 YHZNWER.exe 4844 YHZNWER.exe 3000 EUYVBHG.exe 3000 EUYVBHG.exe 4556 SFHMPSC.exe 4556 SFHMPSC.exe 6028 HVIL.exe 6028 HVIL.exe 1420 LLO.exe 1420 LLO.exe 3872 KWZCI.exe 3872 KWZCI.exe 2496 OEGKV.exe 2496 OEGKV.exe 4304 DHPOGRX.exe 4304 DHPOGRX.exe 1616 UHRT.exe 1616 UHRT.exe 3996 NLVXWE.exe 3996 NLVXWE.exe 3476 HYAGHEY.exe 3476 HYAGHEY.exe 4336 CLFQ.exe 4336 CLFQ.exe 3504 XWNO.exe 3504 XWNO.exe 5480 HWPTBM.exe 5480 HWPTBM.exe 3916 BSUDLMZ.exe 3916 BSUDLMZ.exe 5000 CNYY.exe 5000 CNYY.exe 4716 LVA.exe 4716 LVA.exe 4244 YGQCQ.exe 4244 YGQCQ.exe 4724 QGKPUPA.exe 4724 QGKPUPA.exe 4572 ZTUHJ.exe 4572 ZTUHJ.exe 1268 DWTUJFY.exe 1268 DWTUJFY.exe 5856 SRKHU.exe 5856 SRKHU.exe 5820 EHR.exe 5820 EHR.exe 1528 NITM.exe 1528 NITM.exe 4860 XQVRV.exe 4860 XQVRV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4812 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe 4812 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe 1672 LXPXLM.exe 1672 LXPXLM.exe 5872 JITM.exe 5872 JITM.exe 2392 ZYU.exe 2392 ZYU.exe 2808 COAMS.exe 2808 COAMS.exe 1984 BZDC.exe 1984 BZDC.exe 1228 GEVRQ.exe 1228 GEVRQ.exe 4844 YHZNWER.exe 4844 YHZNWER.exe 3000 EUYVBHG.exe 3000 EUYVBHG.exe 4556 SFHMPSC.exe 4556 SFHMPSC.exe 6028 HVIL.exe 6028 HVIL.exe 1420 LLO.exe 1420 LLO.exe 3872 KWZCI.exe 3872 KWZCI.exe 2496 OEGKV.exe 2496 OEGKV.exe 4304 DHPOGRX.exe 4304 DHPOGRX.exe 1616 UHRT.exe 1616 UHRT.exe 3996 NLVXWE.exe 3996 NLVXWE.exe 3476 HYAGHEY.exe 3476 HYAGHEY.exe 4336 CLFQ.exe 4336 CLFQ.exe 3504 XWNO.exe 3504 XWNO.exe 5480 HWPTBM.exe 5480 HWPTBM.exe 3916 BSUDLMZ.exe 3916 BSUDLMZ.exe 5000 CNYY.exe 5000 CNYY.exe 4716 LVA.exe 4716 LVA.exe 4244 YGQCQ.exe 4244 YGQCQ.exe 4724 QGKPUPA.exe 4724 QGKPUPA.exe 4572 ZTUHJ.exe 4572 ZTUHJ.exe 1268 DWTUJFY.exe 1268 DWTUJFY.exe 5856 SRKHU.exe 5856 SRKHU.exe 5820 EHR.exe 5820 EHR.exe 1528 NITM.exe 1528 NITM.exe 4860 XQVRV.exe 4860 XQVRV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4288 4812 2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe 90 PID 4288 wrote to memory of 1672 4288 cmd.exe 94 PID 1672 wrote to memory of 4396 1672 LXPXLM.exe 96 PID 4396 wrote to memory of 5872 4396 cmd.exe 100 PID 5872 wrote to memory of 1456 5872 JITM.exe 101 PID 1456 wrote to memory of 2392 1456 cmd.exe 105 PID 2392 wrote to memory of 4464 2392 ZYU.exe 106 PID 4464 wrote to memory of 2808 4464 cmd.exe 110 PID 2808 wrote to memory of 4532 2808 COAMS.exe 111 PID 4532 wrote to memory of 1984 4532 cmd.exe 115 PID 1984 wrote to memory of 1124 1984 BZDC.exe 116 PID 1124 wrote to memory of 1228 1124 cmd.exe 120 PID 1228 wrote to memory of 4228 1228 GEVRQ.exe 121 PID 4228 wrote to memory of 4844 4228 cmd.exe 125 PID 4844 wrote to memory of 3040 4844 YHZNWER.exe 126 PID 3040 wrote to memory of 3000 3040 cmd.exe 130 PID 3000 wrote to memory of 1388 3000 EUYVBHG.exe 131 PID 1388 wrote to memory of 4556 1388 cmd.exe 135 PID 4556 wrote to memory of 2052 4556 SFHMPSC.exe 136 PID 2052 wrote to memory of 6028 2052 cmd.exe 140 PID 6028 wrote to memory of 5708 6028 HVIL.exe 141 PID 5708 wrote to memory of 1420 5708 cmd.exe 145 PID 1420 wrote to memory of 4808 1420 LLO.exe 146 PID 4808 wrote to memory of 3872 4808 cmd.exe 150 PID 3872 wrote to memory of 4644 3872 KWZCI.exe 151 PID 4644 wrote to memory of 2496 4644 cmd.exe 155 PID 2496 wrote to memory of 2936 2496 OEGKV.exe 156 PID 2936 wrote to memory of 4304 2936 cmd.exe 160 PID 4304 wrote to memory of 2644 4304 DHPOGRX.exe 161 PID 2644 wrote to memory of 1616 2644 cmd.exe 165 PID 1616 wrote to memory of 5704 1616 UHRT.exe 166 PID 5704 wrote to memory of 3996 5704 cmd.exe 170 PID 3996 wrote to memory of 1924 3996 NLVXWE.exe 171 PID 1924 wrote to memory of 3476 1924 cmd.exe 175 PID 3476 wrote to memory of 4248 3476 HYAGHEY.exe 176 PID 4248 wrote to memory of 4336 4248 cmd.exe 180 PID 4336 wrote to memory of 3396 4336 CLFQ.exe 181 PID 3396 wrote to memory of 3504 3396 cmd.exe 185 PID 3504 wrote to memory of 4760 3504 XWNO.exe 186 PID 4760 wrote to memory of 5480 4760 cmd.exe 190 PID 5480 wrote to memory of 3088 5480 HWPTBM.exe 191 PID 3088 wrote to memory of 3916 3088 cmd.exe 195 PID 3916 wrote to memory of 5312 3916 BSUDLMZ.exe 196 PID 5312 wrote to memory of 5000 5312 cmd.exe 200 PID 5000 wrote to memory of 5920 5000 CNYY.exe 201 PID 5920 wrote to memory of 4716 5920 cmd.exe 205 PID 4716 wrote to memory of 3812 4716 LVA.exe 206 PID 3812 wrote to memory of 4244 3812 cmd.exe 210 PID 4244 wrote to memory of 3540 4244 YGQCQ.exe 211 PID 3540 wrote to memory of 4724 3540 cmd.exe 215 PID 4724 wrote to memory of 4372 4724 QGKPUPA.exe 216 PID 4372 wrote to memory of 4572 4372 cmd.exe 220 PID 4572 wrote to memory of 5040 4572 ZTUHJ.exe 221 PID 5040 wrote to memory of 1268 5040 cmd.exe 225 PID 1268 wrote to memory of 4292 1268 DWTUJFY.exe 226 PID 4292 wrote to memory of 5856 4292 cmd.exe 230 PID 5856 wrote to memory of 5320 5856 SRKHU.exe 231 PID 5320 wrote to memory of 5820 5320 cmd.exe 235 PID 5820 wrote to memory of 5948 5820 EHR.exe 236 PID 5948 wrote to memory of 1528 5948 cmd.exe 240 PID 1528 wrote to memory of 3528 1528 NITM.exe 241 PID 3528 wrote to memory of 4860 3528 cmd.exe 245 PID 4860 wrote to memory of 2208 4860 XQVRV.exe 246 PID 2208 wrote to memory of 3876 2208 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_8ca1b0211add9a3ee4c6d013b1d0cb0b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\system\LXPXLM.exeC:\windows\system\LXPXLM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JITM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\JITM.exeC:\windows\system32\JITM.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\SysWOW64\ZYU.exeC:\windows\system32\ZYU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COAMS.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\system\COAMS.exeC:\windows\system\COAMS.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZDC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\SysWOW64\BZDC.exeC:\windows\system32\BZDC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEVRQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\GEVRQ.exeC:\windows\GEVRQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHZNWER.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\YHZNWER.exeC:\windows\system\YHZNWER.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUYVBHG.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\EUYVBHG.exeC:\windows\system32\EUYVBHG.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFHMPSC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\windows\system\SFHMPSC.exeC:\windows\system\SFHMPSC.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVIL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\HVIL.exeC:\windows\HVIL.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLO.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\SysWOW64\LLO.exeC:\windows\system32\LLO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DHPOGRX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\SysWOW64\DHPOGRX.exeC:\windows\system32\DHPOGRX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\UHRT.exeC:\windows\UHRT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HYAGHEY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\windows\SysWOW64\HYAGHEY.exeC:\windows\system32\HYAGHEY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLFQ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\system\CLFQ.exeC:\windows\system\CLFQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XWNO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\XWNO.exeC:\windows\XWNO.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWPTBM.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\system\HWPTBM.exeC:\windows\system\HWPTBM.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\system\BSUDLMZ.exeC:\windows\system\BSUDLMZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNYY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\CNYY.exeC:\windows\CNYY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\system\LVA.exeC:\windows\system\LVA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGKPUPA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\QGKPUPA.exeC:\windows\QGKPUPA.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWTUJFY.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\system\DWTUJFY.exeC:\windows\system\DWTUJFY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\EHR.exeC:\windows\EHR.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "68⤵PID:2096
-
C:\windows\SREFRP.exeC:\windows\SREFRP.exe69⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHLF.exe.bat" "70⤵PID:5784
-
C:\windows\EHLF.exeC:\windows\EHLF.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUKGIC.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\CUKGIC.exeC:\windows\system32\CUKGIC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXBT.exe.bat" "74⤵PID:296
-
C:\windows\SysWOW64\RXBT.exeC:\windows\system32\RXBT.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4696 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYD.exe.bat" "78⤵PID:3672
-
C:\windows\SysWOW64\OYD.exeC:\windows\system32\OYD.exe79⤵
- Executes dropped EXE
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4772 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe81⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRNS.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4472 -
C:\windows\XRNS.exeC:\windows\XRNS.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "84⤵PID:4140
-
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "86⤵PID:3008
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "88⤵PID:1180
-
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NABVGBR.exe.bat" "90⤵PID:2632
-
C:\windows\SysWOW64\NABVGBR.exeC:\windows\system32\NABVGBR.exe91⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "92⤵PID:4368
-
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe93⤵
- Executes dropped EXE
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLFP.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1792 -
C:\windows\GLFP.exeC:\windows\GLFP.exe95⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGOTFHW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4420 -
C:\windows\system\VGOTFHW.exeC:\windows\system\VGOTFHW.exe97⤵
- Executes dropped EXE
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2800 -
C:\windows\QTTD.exeC:\windows\QTTD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "100⤵PID:4840
-
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe101⤵
- Executes dropped EXE
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "104⤵PID:4404
-
C:\windows\HAW.exeC:\windows\HAW.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNBHT.exe.bat" "106⤵PID:1188
-
C:\windows\CNBHT.exeC:\windows\CNBHT.exe107⤵
- Executes dropped EXE
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3572 -
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLWP.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1240 -
C:\windows\system\SLWP.exeC:\windows\system\SLWP.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "112⤵PID:5004
-
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe113⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5052 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "116⤵PID:988
-
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "118⤵PID:5600
-
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3084 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-