Analysis
- max time kernel
79s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe
- Size 208KB
- Sample261009-ryqqlsbe47
- SHA256 e55605e87387e44f81bb7c6f50cad7fcc4dc6b43d90fe76438584c766d12d702
- MD5 54eda24ce8a6cb555a0f2b1b204c5538
- SHA1 3a2336f65348c26e4784f7a934a19e2aa6772ab8
- SHA512 2e3f85e873bfc83d7eedfaa26cfc4a29c687cff1fd977ef7a826e37a6355d575e95a0e9d0484ea2f30e680861eeda9f37a63119a6ccbe882b2d0b3b70f3addba
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfM4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOkkEj1
- TLSH T1AD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4696 BYFAX.exe 5992 RHA.exe 2984 GCJRZH.exe 4752 CZRD.exe 4464 EXXX.exe 4144 OVDRXJ.exe 5520 GYGND.exe 6052 OETUN.exe 2072 KOB.exe 5780 MMPNJJY.exe 4840 KXSDSX.exe 5572 ANT.exe 2524 TFI.exe 1140 AVJEOH.exe 5844 GWRSXB.exe 1964 HZVOL.exe 5884 LHB.exe 3276 UPDB.exe 1540 PCIKLO.exe 5112 DYULRDL.exe 2680 QICCF.exe 4172 NJMMJ.exe 2732 ZRTM.exe 5620 BPYHCL.exe 688 LNMBST.exe 4792 DQQ.exe 1720 ELTADZG.exe 3188 GIZN.exe 2324 VZA.exe 2920 UWTPMI.exe 5568 YZRC.exe 5848 CHYKYT.exe 1652 DKC.exe 1092 XYHPO.exe 5696 MBQ.exe 4508 WBSHKB.exe 2016 WEW.exe 3388 EKJ.exe 3084 TFSVLK.exe 1116 SXVLU.exe 2724 CYXQXO.exe 3304 KLJXI.exe 2280 EZOGSUR.exe 4896 TUYLD.exe 5692 LCAYHE.exe 5064 BNDGP.exe 4828 HNK.exe 2312 IIOXM.exe 3576 BLS.exe 4160 GLZPAV.exe 5356 WBAGHQA.exe 4392 HUD.exe 1272 JSJ.exe 3004 PSR.exe 5264 ZVW.exe 5740 OQGUIQ.exe 3792 FZIZTOO.exe 1168 NUZEE.exe 4668 PHWNOAD.exe 5168 GAHDXO.exe 5024 ZSCWXVP.exe 2140 XTKKO.exe 4784 OTMPSV.exe 1488 QRZJZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GWRSXB.exe.bat AVJEOH.exe File created C:\windows\SysWOW64\GAHDXO.exe.bat PHWNOAD.exe File opened for modification C:\windows\SysWOW64\RTFLJ.exe HWRRUA.exe File created C:\windows\SysWOW64\FGRGFLI.exe FBYREZN.exe File created C:\windows\SysWOW64\QSRP.exe AXZLDB.exe File opened for modification C:\windows\SysWOW64\QSRP.exe AXZLDB.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe UPDB.exe File created C:\windows\SysWOW64\QICCF.exe DYULRDL.exe File created C:\windows\SysWOW64\VZA.exe GIZN.exe File created C:\windows\SysWOW64\CYXQXO.exe SXVLU.exe File created C:\windows\SysWOW64\HUD.exe.bat WBAGHQA.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe OQGUIQ.exe File opened for modification C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe MBQ.exe File created C:\windows\SysWOW64\WBAGHQA.exe GLZPAV.exe File created C:\windows\SysWOW64\PHWNOAD.exe.bat NUZEE.exe File created C:\windows\SysWOW64\CWWQQEI.exe MLT.exe File opened for modification C:\windows\SysWOW64\FGRGFLI.exe FBYREZN.exe File opened for modification C:\windows\SysWOW64\LNMBST.exe BPYHCL.exe File opened for modification C:\windows\SysWOW64\VZA.exe GIZN.exe File opened for modification C:\windows\SysWOW64\CYXQXO.exe SXVLU.exe File created C:\windows\SysWOW64\CYXQXO.exe.bat SXVLU.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat HWRRUA.exe File created C:\windows\SysWOW64\SCVVW.exe NZXAWBA.exe File created C:\windows\SysWOW64\HXNAP.exe SCVVW.exe File created C:\windows\SysWOW64\NJMMJ.exe.bat QICCF.exe File created C:\windows\SysWOW64\LCAYHE.exe.bat TUYLD.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat OQGUIQ.exe File created C:\windows\SysWOW64\PHWNOAD.exe NUZEE.exe File opened for modification C:\windows\SysWOW64\KXSDSX.exe MMPNJJY.exe File opened for modification C:\windows\SysWOW64\QICCF.exe DYULRDL.exe File created C:\windows\SysWOW64\WBSHKB.exe MBQ.exe File opened for modification C:\windows\SysWOW64\KLJXI.exe CYXQXO.exe File created C:\windows\SysWOW64\HUD.exe WBAGHQA.exe File opened for modification C:\windows\SysWOW64\NUZEE.exe FZIZTOO.exe File created C:\windows\SysWOW64\PCIKLO.exe.bat UPDB.exe File created C:\windows\SysWOW64\VZA.exe.bat GIZN.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe MLT.exe File created C:\windows\SysWOW64\SCVVW.exe.bat NZXAWBA.exe File created C:\windows\SysWOW64\LNMBST.exe BPYHCL.exe File created C:\windows\SysWOW64\LCAYHE.exe TUYLD.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe JJRAKIE.exe File created C:\windows\SysWOW64\KXSDSX.exe MMPNJJY.exe File created C:\windows\SysWOW64\PCIKLO.exe UPDB.exe File created C:\windows\SysWOW64\BPYHCL.exe.bat ZRTM.exe File created C:\windows\SysWOW64\WBSHKB.exe.bat MBQ.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat GLZPAV.exe File created C:\windows\SysWOW64\FZIZTOO.exe OQGUIQ.exe File created C:\windows\SysWOW64\NUZEE.exe FZIZTOO.exe File opened for modification C:\windows\SysWOW64\PHWNOAD.exe NUZEE.exe File created C:\windows\SysWOW64\GWRSXB.exe AVJEOH.exe File created C:\windows\SysWOW64\NUZEE.exe.bat FZIZTOO.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe NZXAWBA.exe File opened for modification C:\windows\SysWOW64\HXNAP.exe SCVVW.exe File created C:\windows\SysWOW64\NJMMJ.exe QICCF.exe File opened for modification C:\windows\SysWOW64\NJMMJ.exe QICCF.exe File created C:\windows\SysWOW64\KLJXI.exe.bat CYXQXO.exe File created C:\windows\SysWOW64\GAHDXO.exe PHWNOAD.exe File opened for modification C:\windows\SysWOW64\GAHDXO.exe PHWNOAD.exe File created C:\windows\SysWOW64\CWWQQEI.exe.bat MLT.exe File created C:\windows\SysWOW64\FGRGFLI.exe.bat FBYREZN.exe File created C:\windows\SysWOW64\QSRP.exe.bat AXZLDB.exe File created C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File opened for modification C:\windows\SysWOW64\LCAYHE.exe TUYLD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\OMCQ.exe CWWQQEI.exe File opened for modification C:\windows\system\BYYN.exe HLTVFYY.exe File created C:\windows\system\GCJRZH.exe.bat RHA.exe File opened for modification C:\windows\system\ANT.exe KXSDSX.exe File opened for modification C:\windows\system\DQQ.exe LNMBST.exe File opened for modification C:\windows\system\ELTADZG.exe DQQ.exe File opened for modification C:\windows\system\JSJ.exe HUD.exe File created C:\windows\system\JSJ.exe.bat HUD.exe File created C:\windows\system\IPYGPCS.exe TMOBWP.exe File created C:\windows\system\ULDSUYU.exe.bat XTU.exe File created C:\windows\DYULRDL.exe.bat PCIKLO.exe File created C:\windows\system\EZOGSUR.exe.bat KLJXI.exe File opened for modification C:\windows\ZVW.exe QVUDTYB.exe File opened for modification C:\windows\system\RSMCZZ.exe LXVTU.exe File created C:\windows\system\RSMCZZ.exe.bat LXVTU.exe File opened for modification C:\windows\system\ZLLGD.exe ULDSUYU.exe File opened for modification C:\windows\JJRAKIE.exe ZLLGD.exe File created C:\windows\system\UBIKY.exe.bat FGRGFLI.exe File created C:\windows\system\YZRC.exe.bat UWTPMI.exe File created C:\windows\DKC.exe CHYKYT.exe File created C:\windows\system\IZBODBD.exe.bat QRZJZ.exe File created C:\windows\system\EXXX.exe CZRD.exe File created C:\windows\ZSCWXVP.exe GAHDXO.exe File created C:\windows\system\QRZJZ.exe OTMPSV.exe File opened for modification C:\windows\system\QRZJZ.exe OTMPSV.exe File created C:\windows\system\ORJC.exe.bat IZBODBD.exe File opened for modification C:\windows\system\HWRRUA.exe XNPM.exe File opened for modification C:\windows\AXZLDB.exe UBIKY.exe File created C:\windows\system\BYYN.exe HLTVFYY.exe File created C:\windows\system\YZRC.exe UWTPMI.exe File created C:\windows\EKJ.exe WEW.exe File created C:\windows\system\TUYLD.exe.bat EZOGSUR.exe File created C:\windows\system\BNDGP.exe LCAYHE.exe File created C:\windows\IIOXM.exe.bat HNK.exe File created C:\windows\PSR.exe.bat JSJ.exe File created C:\windows\ZVW.exe.bat QVUDTYB.exe File opened for modification C:\windows\system\IZBODBD.exe QRZJZ.exe File created C:\windows\system\TFSVLK.exe.bat EKJ.exe File opened for modification C:\windows\system\EXXX.exe CZRD.exe File created C:\windows\KOB.exe OETUN.exe File opened for modification C:\windows\system\AVJEOH.exe TFI.exe File opened for modification C:\windows\LHB.exe HZVOL.exe File created C:\windows\system\ELTADZG.exe DQQ.exe File opened for modification C:\windows\XYHPO.exe DKC.exe File created C:\windows\LSIP.exe ORJC.exe File created C:\windows\system\ELTADZG.exe.bat DQQ.exe File opened for modification C:\windows\system\OTMPSV.exe XTKKO.exe File created C:\windows\RNIYHAW.exe.bat LSIP.exe File created C:\windows\BKMIW.exe QSRP.exe File created C:\windows\system\HLTVFYY.exe.bat BKMIW.exe File created C:\windows\system\BYYN.exe.bat HLTVFYY.exe File opened for modification C:\windows\GYGND.exe OVDRXJ.exe File opened for modification C:\windows\KOB.exe OETUN.exe File created C:\windows\system\ZRTM.exe NJMMJ.exe File created C:\windows\RNIYHAW.exe LSIP.exe File created C:\windows\XNPM.exe RNIYHAW.exe File created C:\windows\LXVTU.exe.bat YMEDG.exe File opened for modification C:\windows\system\FBYREZN.exe BLSJ.exe File created C:\windows\KOB.exe.bat OETUN.exe File opened for modification C:\windows\system\ZRTM.exe NJMMJ.exe File opened for modification C:\windows\UWTPMI.exe VZA.exe File opened for modification C:\windows\DKC.exe CHYKYT.exe File created C:\windows\system\WEW.exe WBSHKB.exe File opened for modification C:\windows\system\WEW.exe WBSHKB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2924 cmd.exe 2520 cmd.exe 5688 cmd.exe 4704 cmd.exe 3340 cmd.exe 5068 cmd.exe 5880 cmd.exe 1472 cmd.exe 1688 cmd.exe 3224 cmd.exe 4944 cmd.exe 3264 cmd.exe 1408 cmd.exe 3064 cmd.exe 3248 cmd.exe 3512 cmd.exe 4688 cmd.exe 3856 cmd.exe 3392 cmd.exe 464 cmd.exe 3824 cmd.exe 4460 cmd.exe 2996 cmd.exe 3480 cmd.exe 1088 cmd.exe 1324 cmd.exe 956 cmd.exe 5700 cmd.exe 4316 cmd.exe 2440 cmd.exe 4596 cmd.exe 3736 cmd.exe 2020 cmd.exe 2404 cmd.exe 4232 cmd.exe 1968 cmd.exe 5128 cmd.exe 1164 cmd.exe 3428 cmd.exe 120 cmd.exe 1132 cmd.exe 5480 cmd.exe 4712 cmd.exe 1240 cmd.exe 2884 cmd.exe 2980 cmd.exe 4228 cmd.exe 796 cmd.exe 4640 cmd.exe 5776 cmd.exe 4384 cmd.exe 6132 cmd.exe 2904 cmd.exe 3208 cmd.exe 1952 cmd.exe 4136 cmd.exe 4288 cmd.exe 2488 cmd.exe 5472 cmd.exe 1580 cmd.exe 2460 cmd.exe 3240 cmd.exe 2868 cmd.exe 5936 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2400 912 WerFault.exe 87 2656 4696 WerFault.exe 92 1996 5992 WerFault.exe 99 4108 2984 WerFault.exe 104 1860 4752 WerFault.exe 109 6060 4464 WerFault.exe 114 6048 4144 WerFault.exe 119 2924 5520 WerFault.exe 124 3560 6052 WerFault.exe 129 936 2072 WerFault.exe 134 4172 5780 WerFault.exe 139 3524 4840 WerFault.exe 144 4312 5572 WerFault.exe 149 992 2524 WerFault.exe 154 1452 1140 WerFault.exe 159 1628 5844 WerFault.exe 164 4548 1964 WerFault.exe 169 5740 5884 WerFault.exe 174 3192 3276 WerFault.exe 179 3560 1540 WerFault.exe 184 676 5112 WerFault.exe 189 4156 2680 WerFault.exe 194 1092 4172 WerFault.exe 199 5484 2732 WerFault.exe 204 5788 5620 WerFault.exe 209 1408 688 WerFault.exe 214 5892 4792 WerFault.exe 219 596 1720 WerFault.exe 224 3204 3188 WerFault.exe 229 1668 2324 WerFault.exe 234 4456 2920 WerFault.exe 239 4488 5568 WerFault.exe 244 4136 5848 WerFault.exe 249 4580 1652 WerFault.exe 254 472 1092 WerFault.exe 259 1324 5696 WerFault.exe 264 1832 4508 WerFault.exe 269 2036 2016 WerFault.exe 275 800 3388 WerFault.exe 280 5804 3084 WerFault.exe 285 4668 1116 WerFault.exe 290 2296 2724 WerFault.exe 295 4972 3304 WerFault.exe 300 5440 2280 WerFault.exe 305 1740 4896 WerFault.exe 310 2540 5692 WerFault.exe 315 4212 5064 WerFault.exe 320 6060 4828 WerFault.exe 325 5888 2312 WerFault.exe 330 6140 3576 WerFault.exe 335 3864 4160 WerFault.exe 340 5504 5356 WerFault.exe 345 3404 4392 WerFault.exe 350 5440 1272 WerFault.exe 355 2220 3004 WerFault.exe 360 5472 4992 WerFault.exe 365 3372 5264 WerFault.exe 370 5640 5740 WerFault.exe 375 1228 3792 WerFault.exe 380 676 1168 WerFault.exe 385 2988 4668 WerFault.exe 390 5760 5168 WerFault.exe 395 3524 5024 WerFault.exe 400 4216 2140 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZOGSUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXSDSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNMBST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVUDTYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNIYHAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLJXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGRGFLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVDRXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQGUIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULDSUYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OETUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWRSXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZVOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYULRDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNDGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYXQXO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIPECA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFSVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZBODBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTFLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPYGPCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTMPSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe 912 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe 4696 BYFAX.exe 4696 BYFAX.exe 5992 RHA.exe 5992 RHA.exe 2984 GCJRZH.exe 2984 GCJRZH.exe 4752 CZRD.exe 4752 CZRD.exe 4464 EXXX.exe 4464 EXXX.exe 4144 OVDRXJ.exe 4144 OVDRXJ.exe 5520 GYGND.exe 5520 GYGND.exe 6052 OETUN.exe 6052 OETUN.exe 2072 KOB.exe 2072 KOB.exe 5780 MMPNJJY.exe 5780 MMPNJJY.exe 4840 KXSDSX.exe 4840 KXSDSX.exe 5572 ANT.exe 5572 ANT.exe 2524 TFI.exe 2524 TFI.exe 1140 AVJEOH.exe 1140 AVJEOH.exe 5844 GWRSXB.exe 5844 GWRSXB.exe 1964 HZVOL.exe 1964 HZVOL.exe 5884 LHB.exe 5884 LHB.exe 3276 UPDB.exe 3276 UPDB.exe 1540 PCIKLO.exe 1540 PCIKLO.exe 5112 DYULRDL.exe 5112 DYULRDL.exe 2680 QICCF.exe 2680 QICCF.exe 4172 NJMMJ.exe 4172 NJMMJ.exe 2732 ZRTM.exe 2732 ZRTM.exe 5620 BPYHCL.exe 5620 BPYHCL.exe 688 LNMBST.exe 688 LNMBST.exe 4792 DQQ.exe 4792 DQQ.exe 1720 ELTADZG.exe 1720 ELTADZG.exe 3188 GIZN.exe 3188 GIZN.exe 2324 VZA.exe 2324 VZA.exe 2920 UWTPMI.exe 2920 UWTPMI.exe 5568 YZRC.exe 5568 YZRC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 912 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe 912 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe 4696 BYFAX.exe 4696 BYFAX.exe 5992 RHA.exe 5992 RHA.exe 2984 GCJRZH.exe 2984 GCJRZH.exe 4752 CZRD.exe 4752 CZRD.exe 4464 EXXX.exe 4464 EXXX.exe 4144 OVDRXJ.exe 4144 OVDRXJ.exe 5520 GYGND.exe 5520 GYGND.exe 6052 OETUN.exe 6052 OETUN.exe 2072 KOB.exe 2072 KOB.exe 5780 MMPNJJY.exe 5780 MMPNJJY.exe 4840 KXSDSX.exe 4840 KXSDSX.exe 5572 ANT.exe 5572 ANT.exe 2524 TFI.exe 2524 TFI.exe 1140 AVJEOH.exe 1140 AVJEOH.exe 5844 GWRSXB.exe 5844 GWRSXB.exe 1964 HZVOL.exe 1964 HZVOL.exe 5884 LHB.exe 5884 LHB.exe 3276 UPDB.exe 3276 UPDB.exe 1540 PCIKLO.exe 1540 PCIKLO.exe 5112 DYULRDL.exe 5112 DYULRDL.exe 2680 QICCF.exe 2680 QICCF.exe 4172 NJMMJ.exe 4172 NJMMJ.exe 2732 ZRTM.exe 2732 ZRTM.exe 5620 BPYHCL.exe 5620 BPYHCL.exe 688 LNMBST.exe 688 LNMBST.exe 4792 DQQ.exe 4792 DQQ.exe 1720 ELTADZG.exe 1720 ELTADZG.exe 3188 GIZN.exe 3188 GIZN.exe 2324 VZA.exe 2324 VZA.exe 2920 UWTPMI.exe 2920 UWTPMI.exe 5568 YZRC.exe 5568 YZRC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 912 wrote to memory of 4832 912 2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe 89 PID 4832 wrote to memory of 4696 4832 cmd.exe 92 PID 4696 wrote to memory of 1208 4696 BYFAX.exe 95 PID 1208 wrote to memory of 5992 1208 cmd.exe 99 PID 5992 wrote to memory of 5172 5992 RHA.exe 100 PID 5172 wrote to memory of 2984 5172 cmd.exe 104 PID 2984 wrote to memory of 3032 2984 GCJRZH.exe 105 PID 3032 wrote to memory of 4752 3032 cmd.exe 109 PID 4752 wrote to memory of 2096 4752 CZRD.exe 110 PID 2096 wrote to memory of 4464 2096 cmd.exe 114 PID 4464 wrote to memory of 796 4464 EXXX.exe 115 PID 796 wrote to memory of 4144 796 cmd.exe 119 PID 4144 wrote to memory of 4272 4144 OVDRXJ.exe 120 PID 4272 wrote to memory of 5520 4272 cmd.exe 124 PID 5520 wrote to memory of 708 5520 GYGND.exe 125 PID 708 wrote to memory of 6052 708 cmd.exe 129 PID 6052 wrote to memory of 4900 6052 OETUN.exe 130 PID 4900 wrote to memory of 2072 4900 cmd.exe 134 PID 2072 wrote to memory of 3512 2072 KOB.exe 135 PID 3512 wrote to memory of 5780 3512 cmd.exe 139 PID 5780 wrote to memory of 5936 5780 MMPNJJY.exe 140 PID 5936 wrote to memory of 4840 5936 cmd.exe 144 PID 4840 wrote to memory of 5020 4840 KXSDSX.exe 145 PID 5020 wrote to memory of 5572 5020 cmd.exe 149 PID 5572 wrote to memory of 3588 5572 ANT.exe 150 PID 3588 wrote to memory of 2524 3588 cmd.exe 154 PID 2524 wrote to memory of 4640 2524 TFI.exe 155 PID 4640 wrote to memory of 1140 4640 cmd.exe 159 PID 1140 wrote to memory of 6008 1140 AVJEOH.exe 160 PID 6008 wrote to memory of 5844 6008 cmd.exe 164 PID 5844 wrote to memory of 6120 5844 GWRSXB.exe 165 PID 6120 wrote to memory of 1964 6120 cmd.exe 169 PID 1964 wrote to memory of 4432 1964 HZVOL.exe 170 PID 4432 wrote to memory of 5884 4432 cmd.exe 174 PID 5884 wrote to memory of 5284 5884 LHB.exe 175 PID 5284 wrote to memory of 3276 5284 cmd.exe 179 PID 3276 wrote to memory of 2876 3276 UPDB.exe 180 PID 2876 wrote to memory of 1540 2876 cmd.exe 184 PID 1540 wrote to memory of 6020 1540 PCIKLO.exe 185 PID 6020 wrote to memory of 5112 6020 cmd.exe 189 PID 5112 wrote to memory of 5068 5112 DYULRDL.exe 190 PID 5068 wrote to memory of 2680 5068 cmd.exe 194 PID 2680 wrote to memory of 3224 2680 QICCF.exe 195 PID 3224 wrote to memory of 4172 3224 cmd.exe 199 PID 4172 wrote to memory of 5800 4172 NJMMJ.exe 200 PID 5800 wrote to memory of 2732 5800 cmd.exe 204 PID 2732 wrote to memory of 4316 2732 ZRTM.exe 205 PID 4316 wrote to memory of 5620 4316 cmd.exe 209 PID 5620 wrote to memory of 620 5620 BPYHCL.exe 210 PID 620 wrote to memory of 688 620 cmd.exe 214 PID 688 wrote to memory of 2976 688 LNMBST.exe 215 PID 2976 wrote to memory of 4792 2976 cmd.exe 219 PID 4792 wrote to memory of 2868 4792 DQQ.exe 220 PID 2868 wrote to memory of 1720 2868 cmd.exe 224 PID 1720 wrote to memory of 3620 1720 ELTADZG.exe 225 PID 3620 wrote to memory of 3188 3620 cmd.exe 229 PID 3188 wrote to memory of 1088 3188 GIZN.exe 230 PID 1088 wrote to memory of 2324 1088 cmd.exe 234 PID 2324 wrote to memory of 4320 2324 VZA.exe 235 PID 4320 wrote to memory of 2920 4320 cmd.exe 239 PID 2920 wrote to memory of 5148 2920 UWTPMI.exe 240 PID 5148 wrote to memory of 5568 5148 cmd.exe 244 PID 5568 wrote to memory of 5584 5568 YZRC.exe 245 PID 5584 wrote to memory of 5848 5584 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_54eda24ce8a6cb555a0f2b1b204c5538_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYFAX.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\BYFAX.exeC:\windows\BYFAX.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHA.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\system\RHA.exeC:\windows\system\RHA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCJRZH.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\windows\system\GCJRZH.exeC:\windows\system\GCJRZH.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZRD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\CZRD.exeC:\windows\CZRD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXXX.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\windows\system\EXXX.exeC:\windows\system\EXXX.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\GYGND.exeC:\windows\GYGND.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\windows\KOB.exeC:\windows\KOB.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MMPNJJY.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\MMPNJJY.exeC:\windows\MMPNJJY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXSDSX.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\SysWOW64\KXSDSX.exeC:\windows\system32\KXSDSX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANT.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\ANT.exeC:\windows\system\ANT.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\system\TFI.exeC:\windows\system\TFI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWRSXB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SysWOW64\GWRSXB.exeC:\windows\system32\GWRSXB.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZVOL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\HZVOL.exeC:\windows\HZVOL.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\LHB.exeC:\windows\LHB.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPDB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\UPDB.exeC:\windows\UPDB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJMMJ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\SysWOW64\NJMMJ.exeC:\windows\system32\NJMMJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPYHCL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\SysWOW64\BPYHCL.exeC:\windows\system32\BPYHCL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNMBST.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\SysWOW64\LNMBST.exeC:\windows\system32\LNMBST.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\GIZN.exeC:\windows\GIZN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZA.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\SysWOW64\VZA.exeC:\windows\system32\VZA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKC.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5772 -
C:\windows\DKC.exeC:\windows\DKC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4944 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe69⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5776 -
C:\windows\MBQ.exeC:\windows\MBQ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "72⤵PID:260
-
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEW.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5864 -
C:\windows\system\WEW.exeC:\windows\system\WEW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKJ.exe.bat" "76⤵PID:4964
-
C:\windows\EKJ.exeC:\windows\EKJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "78⤵PID:5060
-
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXVLU.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\windows\system\SXVLU.exeC:\windows\system\SXVLU.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYXQXO.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5880 -
C:\windows\SysWOW64\CYXQXO.exeC:\windows\system32\CYXQXO.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "84⤵PID:5156
-
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5128 -
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "88⤵PID:3628
-
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "92⤵PID:2656
-
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNK.exe.bat" "94⤵PID:4140
-
C:\windows\system\HNK.exeC:\windows\system\HNK.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4384 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe97⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLS.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4688 -
C:\windows\system\BLS.exeC:\windows\system\BLS.exe99⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "100⤵PID:5512
-
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBAGHQA.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4460 -
C:\windows\SysWOW64\WBAGHQA.exeC:\windows\system32\WBAGHQA.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUD.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3340 -
C:\windows\SysWOW64\HUD.exeC:\windows\system32\HUD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSJ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4228 -
C:\windows\system\JSJ.exeC:\windows\system\JSJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1952 -
C:\windows\PSR.exeC:\windows\PSR.exe109⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "110⤵PID:4332
-
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe111⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVW.exe.bat" "112⤵PID:572
-
C:\windows\ZVW.exeC:\windows\ZVW.exe113⤵
- Executes dropped EXE
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQGUIQ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2440 -
C:\windows\OQGUIQ.exeC:\windows\OQGUIQ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZIZTOO.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2924 -
C:\windows\SysWOW64\FZIZTOO.exeC:\windows\system32\FZIZTOO.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUZEE.exe.bat" "118⤵PID:200
-
C:\windows\SysWOW64\NUZEE.exeC:\windows\system32\NUZEE.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PHWNOAD.exe.bat" "120⤵PID:4184
-
C:\windows\SysWOW64\PHWNOAD.exeC:\windows\system32\PHWNOAD.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-